Restrict apps from using the 'unreachable network'

The unreachable network in Netd is designed for PANS feature. Disallow
arbitrary apps to use it, or it may become harder to change and/or
difficult or impossible to delete when apps start to depend on.

Test: atest
Change-Id: Iee6edd24ef5c2383a125a2b78ce63951f6da9d16