Decouple User Sensitive update from grantOrUpgrade in Policy Service

Parts of the policy service code get skipped when the access checking
system is active. However, we don't want user sensitivity updates to be
a part of this. Pull it out into its own method.

Bug: 324538291
Test: manual, presubmit
Change-Id: I88c82eca2c5ae557d9fd212e12f59cbe35cf9629