Use POLICY_REJECT_ALL instead of allowlist

This allows us to keep track of a user's explicit intention to deny
network access to a UID while still allowing newly-added system apps
to have network access by default. It also allows us to retain an
app's network access allowed state when it is hidden and unhidden.

Issue: calyxos#1273
Issue: calyxos#1568
Change-Id: I74407c21cd4ed2cdd932d634577ae07d0bad67b1