Enable device management role holder to set app restrictions

Give DMRH the ability to set app restrictions on any target applications
in the calling user, as well as the parent user of a COPE profile. App
restrictions will be automatically propagated to the private space if they
are set on the parent user of a COPE profile.

App restrictions set by the DMRH are handled by policy engine as coexisable.
Existing app restrictions set by DPC are kept untouched so they are
mostly indepenent from the ones set by the DMRH.

Bug: 304969881
Test: ApplicationRestrictionsTest

Change-Id: Iffb8a0b4a7bf14350f52676d5d7d9d75a1c96393