Firewall: Network access toggle support

Everything needed to support prohibiting apps' overall network access,
apart from changes for Settings / Firewall app.

"Firewall: Migrate to POLICY_REJECT_ALL" is critical to include, too,
if existing installations with prior implementations must be supported.

Update restriction rules for an app when it is being updated/replaced,
not only when it is installed for the first time. Use the latest data
when checking for internet permission.

Co-authored-by: Chirayu Desai <chirayudesai1@gmail.com>
Co-authored-by: Tommy Webb <tommy@calyxinstitute.org>
Change-Id2: I608a792e54cad347f4c256029a2959d6f6b45e3b
Change-Id: I5fae5389776196175eba31f646efff6771824dcc