Only allow System apps to make VPN exempt routes

requestRouteToHost will only allow system applications to make routes
exempt from the VPN's routing rules.

If a VPN is currently running and a non-system app requests a route it
will only succeed if that host is currently covered by a VPN exempt
routing rule. Otherwise it will fail.

For example, if a VPN is running and the MMS network is brought online
those routes will be added as VPN exempt. If an application then tries
to request a route to a MMS endpoint it will succeed because the routes
already exist. If an application tries to request a route to a host
covered by the VPN the call will fail.

Bug: 12937545
Change-Id: If7bcec91bbb96c62c8fb69748c975847e6c00b6f