Set fg app op to fg mode when denying bg

Ensure that the app op we attempt to set when denying a background
permission is the app op corresponding to the foreground permission, not
the background permission

Test: Deny background access to a group. The app op mode for the
foreground permissions should be MODE_FOREGROUND

Change-Id: Ibb0c17a05829e001951c128351bbe55eb275a67a