Allow role to grant/revoke app op permissions.

App op permissions works in a way that's significantly different from
runtime permissions and app ops. Unlike runtime permissions, it
doesn't grant/revoke the permission, and haven't involved any
permission flags so far. Unlike app ops, it requires the app to
request the permission first, and may set either UID or package mode
depending on the app op. So we need a separate class to handle it.

Fixes: 147819526
Test: manual
Change-Id: I4fea0a6adf6eb91cf474cbc5fb991039e6c6ee0d