Explicitly exempt grandfathered permissions

I'm still seeing these being attempted to get auto-revoke, so let's have
an explicit rule to exempt them

Test: presubmit
Bug: 153607914
Change-Id: I70af6c26d7778614bc2bfe0c70ec6ae8e9780245