Allow apps to bulk revoke permissions

This new inteface allows apps that have the revoke-permissions
permission to revoke several permissions at once while following
the same same semantics as the platform.

This is necessary as revoking permissions requires all kinds of
additional checks for non-public flags.

Test: atest PermissionControllerTest
Change-Id: I5ddb683bc8eadf9002428d4ba150ef4a85e1fd01