Make sure to always upgrade runtime permissions

- For users running when the PermissionPolicyService is initialized we
  are not running onStartUser. Hence we have force to do this in
  onBootPhase
- Only write the runtime-permission fingerprint after all permission
  upgrade steps are done
  - This also means that if a user was not started in the first boot
    after an OTA we do not upgrade the fingerprint until the user was
    eventually started

Fixes: 132737426
Test: - Started a fresh build
      - Rebooted
      - Simulated an OTA
      - Added a second user
      - Simulated an OTA with a second user, rebooted and only then
        started the second user
Change-Id: I0758e8bdfefc16139bde2444f126adc3b0a17526