Add new appop for Platform VPNs

This change introduces a new appop, ACTIVATE_PLATFORM_VPN, that is a
subset of the ACTIVATE_VPN appop. VPN apps that have been granted the
more dangerous ACTIVATE_VPN appop should be allowed to use platform
VPNs, as they are more restricted, and safer. However, the opposite
must not be true.

Bug: 144246835
Test: Compiles, FrameworksNetTests passing
Change-Id: I609e87e688432f957751058b09f350fa641753d7