DO NOT MERGE: Verify INSTALL_PACKAGES permissions when adding installer package

Without this check, any package can set the installer package of
another package whose installer has been removed or was never set.
This provides access to other privileged actions and is undesired.

Bug: 150857253

Test: manual verify with proof of concept in linked bug
Test: atest android.appsecurity.cts.PackageSetInstallerTest

[basilgello: Backport to 14.1:
 - callingUid -> Binder.getCallingUid()]
Signed-off-by: Vasyl Gello <vasek.gello@gmail.com>

Change-Id: I2159c357911ff39ffd819054b42f96ae86bc98bc
(cherry picked from commit fc8bfed5)