Add back the role-dependent VDM mirror display logic.

It was removed in favor of the new ADD_MIRROR_DISPLAY permission
but that permission is not launching in 25Q2 and we want to only
allow APP_STREAMING role holders to create mirror displays before
that.

Bug: 368573883
Fix: 380473997
Test: presubmit
Flag: EXEMPT bugfix
Change-Id: Ic10f74c43a3263d3a8590e752af9ca737dec096f