dumpstate: call su before executing librank

librank uses /proc/PID/pagemap . Rather than granting dumpstate
CAP_SYS_ADMIN, have librank run from the SU domain.

Addresses the following denial:

  avc: denied { sys_admin } for pid=6442 comm="librank" capability=21 scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=capability permissive=0

This also allows us to remove the setuid bit from librank,
which will be done in a different commit.

Bug: 25739721
Change-Id: Ibf20d67dbe01b95e5cbb860a7e0eb767b8beb74a