Only load group data is needed

- E.g. not for a new user

Here is why a certain upgrade step is run:
- The whitelisting of restricted permissions needs to be done even for new
  users.
- The grant expansion of bg loc perm is only for the upgrade P->Q.
- The grant expansion of the access-media-location is only needed when
  upgrading from Q. I.e. not for new users created on R

Test: Booted, measured performance. Verified whitelisting
Bug: 150407536
Change-Id: Ifc4a7f3feba2fa1f5586b6cb93d8c8f071a930cd