Add controller APIs for RoleManager.

This change adds addRoleHolderFromController() and
removeRoleHolderFromController() to RoleManager. These APIs are
guarded by permission and intended to be called only by the controller
service, which will only modify records inside RoleManager and won't
affect the holder packages.

Bug: 110557011
Test: build
Change-Id: I15c6cde0b8c1c8c519ea521bc7bb6f97c7144ec4