Add system server test API to force enforce signature permission allowlist.

So that we can test it in cts-root.

This CL also creates a PermissionManagerLocal that is suitable for
exposing system server local APIs.

Bug: 308573169
Test: SignaturePermissionAllowlistTest
Ignore-AOSP-First: New directory
Change-Id: I5df799fd321e54b6cea14a929529a27f6436161c