Add an updateAppPermission() API call to the AccountManagerService AIDL

and have the GrantCredentialsPermissionActivity call that instead of a
static so that it can be made to run in a different process than the
AccountManagerService. Protect this call by checking that the caller
has the same UID as the system process.

Bug: 6545417
Change-Id: I295e65cad68883349a47e7927c171af45c89b229