Make WRITE_APN_SETTINGS a system-only permission.

Protects us from apps getting packet snooping ability
(ie, routing all your traffic through their server by
modifing your APN settings).  We may eventually revert this
if/when we have time to provide a proper API and scary UI
like VPN has.

bug:5242750
Change-Id: I71d73807ca5268c6aacc2156839b4d11427048c4