Add package filter for system_server stubs

Should prevent accidental addition of APIs outside com.android,
which is where we want these APIs to be.

Also fix a bug in the permission filegroup where it wasn't
specifying the subpath of its code.

Bug: 149293194
Test: m update-api
Change-Id: I144ce6dbfe524106fc7de87318f66390c31b45af