Use FLAG_PERMISSION_GRANTED_BY_ROLE for permissions granted by role.

We should only revoke permission that is granted by role, not the ones
that were already granted before role is granted.

Bug: 124452117
Bug: 130231314
Bug: 131252995
Test: presubmit
Change-Id: I2f8a90bd3e0a8dca2e6000d290bcfe163ba75624