system_server: optimize app idle parole state change

Currently when app idle parole state changes, all idle apps' states
are updated one by one including firewall modifications which are
very expensive.  This optimization gets rid of individual firewall
rule changes and makes sure we only modify the firewall once at child
chain level.

BUG: 21446713
Change-Id: Iafc415fe0bc127826fe17894d4fedcf1755cb17d