Restrict apps without INTERNET permission

Ensure that apps which lack the INTERNET permission are not placed on
the restricted mode allowlist; however, also ensure that UidBlockedState
continues to *not* indicate such apps as restricted, in order to work
around issues this causes, like preventing such apps from knowing the
device is connected to a network even with ACCESS_NETWORK_STATE
(see calyxos#1266).

TODO: Handle above issue for INTERNET+blocked apps? See code comments.

Test: Manual: Install app without INTERNET permission. Check that
`adb shell dumpsys connectivity trafficcontroller` does not show
`RESTRICTED_MATCH` for its uid and `adb shell dumpsys netpolicy` *does*
show `REJECT_ALL` for its uid. Update to a variant with INTERNET.
Confirm the same. (Obtain uid using `adb shell pm list packages -U`.)

Issue: calyxos#2657
Reported-by: lucasmz
Related-Change-Id: I11e30bc0c1f8c722d2b5941c17d430dba942594d
Change-Id: I619ffd84d0b495212a98d09edd576f259a663673