Add FLAG_PERMISSION_GRANTED_BY_ROLE.

We need a flag to track permissions granted by role, otherwise upon
revocation we might revoke permission that was already granted before
the role is granted.

Bug: 124452117
Bug: 130231314
Bug: 131252995
Test: presubmit
Change-Id: I0abd89756e8dc943c19d18315a8dcc6890f6fd2d