More encryption-aware triaging.

Most of these callers are okay having results omitted when a package
is uninstalled or encryption unaware.  For example, jobs and
notifications can only be enqueued by already running apps.

When clearing zen rules, keep around rules inserted by apps on
ejected external storage devices.

Make ServiceWatcher stricter by requiring that the matching package
be in the system image.

Bug: 26471205, 27105254
Change-Id: Ie41ea8042ac1a54e9cbe0c35cec89e70521e9bed