Guard DISABLE_PLUGIN with PLUGIN permission.

Fixes a p0 security bug. We already have the plugin permission
defined in our manifest. Ensure that senders of the DISABLE_PLUGIN
broadcast have that permission.

Fixes: 193444889
Test: manual
Change-Id: Iebaba435c17c5644c5357c0683858447f5ffb897