Move backup state to settings, change permission checks to use symbol.

This changes the backup service to use the settings provider instead
of system properties, correspondingly making it off by default and
allowing specific devices to define the transport.  Also tweaks
the permission checks to use the permission symbol instead of raw
strings.

This requires some corresponding changes in the vendor projects.