restricted-networking: Only add newly installed apps to the allowlist, not upgrades

* Upgrading apps still sends PACKAGE_ADDED, since it's sent for
  "new package installs", which technically an upgrade still is.
* Check EXTRA_REPLACING to see if it's a new app.
* Avoids unconditionally turning on networking on app upgrade

Change-Id: Ie7a4090101d47c7033b7f41792e943129dba0700