Use MATCH_ANY_USER when checking for system apps

Also simplified logic a bit, returning earlier if the package is
permitted to avoid unnecessary calls to PM. Also added diagnostic
logging.

Bug: 354675962
Test: TH + manual including HSUM
Flag: EXEMPT bugfix in localized component
Change-Id: Ia7345f150be84f085c2095c75a9765e494ec6111