Fix crash when startForeground posts a broken Notification.

The NotificationManager tries to crash the calling app, but
in the case of a service calling startForeground, the caller
is the ActivityManager, so system_server goes down.

NotificationManagerService#enqueueNotificationInternal is a
new internal-only method that accepts a UID/PID to use when
punishing bogus notifications (such as the one in
http://b/2869787).

Change-Id: I84a9854bae630bc90288cebb94f174809d5dac8c