Move permission restore code into permission controller.

- Split system-server internal interface in two. One accessible only
  inside of the services part of system server. One accessible
  everywhere. This is necessary as the second part needs to be
  accessible by the PermissionBackupHelper. But the former uses internal
  data structures that should not be moved into android.permission.
- Remove old delayed permission restore code from
  PermissionManagerService and Settings. This code now lives in
  permission controller
- Keep the logic to remember which users still have delayed permissions
  left. It is quite expensive to call into permission controller for
  ever install of an app, hence this check is necessary. Currently this
  mirrors the original logic. This can be improved further later.

Test: Built
Change-Id: Ibc1d5183c361dc55896882db1f7b765e1bee6e84