Move permission restore code into permission controller.

This still follows the logic from the code that used to be in system
server.

Test: Built
Change-Id: Ie1f4f7cd17ba59e18b15886d9c3ed038f14032a6