Allow carrier-privileged apps to register telephony listeners.

For TelephonyManager#listen, we check carrier privileges if
READ_PHONE_STATE is missing for any calls which enforce the
permission. For calls which check it and behave differently (by
redacting sensitive info), we defer the permission check until the
actual event occurs, at which point it is checked based on the current
state of the device.

For SubscriptionManager#addOnSubscriptionsChangedListener, we remove
the existing permission check for READ_PHONE_STATE altogether. The
event itself contains no information, and reading subscriptions still
requires either READ_PHONE_STATE or carrier privileges on the
subscription in question.

Also updates incorrect Javadoc on
PhoneStateListener#LISTEN_SIGNAL_STRENGTH, which does not actually
check any permissions by design.

Bug: 70041899
Fixes: 74034127
Test: TreeHugger + E2E test w/ a carrier-privileged app
Change-Id: I84a56ad3972b9edcfdefcbb43ef174c54cdcac00
Merged-In: I84a56ad3972b9edcfdefcbb43ef174c54cdcac00
(cherry pick from commit 62b994b3)