Fix cross-user talk.

An app can access widgets hosted or provided by its uid and package.
Access is also allowed if the caller has the bind app widgets permission
but this caller can be in the wrong user. Now the caller should not
only have the bind app widget permission but also be in the same user
as the host or the provider of the widget.

bug:16834230

Change-Id: I5ddb6309f63f2b4ba95360446c2b9584350fb66f