Allow bindServiceAsUser without _FULL if same app

Previously we allowed bindServiceAsUser in the following situations:
* caller has INTERACT_ACROSS_USERS_FULL
* caller has INTERACT_ACROSS_USERS and is in same profile group
* caller has INTERACT_ACROSS_PROFILES and is in same profile group and is the same app as the service

We now additionally allow:
* caller has INTERACT_ACROSS_USERS and is the same app as the service
(regardless of whether it is in the same profile group)

Bug: 209989958
Test: tested locally that granting the permission allows access to bindServiceAsUser
Test: atest UserControllerTest
Change-Id: I47d6f86fd159aa993971366ee9d7d334644d391e