Grant only requested permissions not the whole group.

The policy for an app requesting permissions is that only the requested permissions
are granted not the whole groups to which these permissions belong. There was a
regression where we granted the whole group not only the requested permissions. If
an app has a permission in a group already granted, now per policy a subsequent
request from the same group is followed by an auto grant.

bug:23370436

Change-Id: Icce6377d60187f6f153d10d646cd8c9878dd6fab