Implement service filtering

Instant apps can no longer see services that haven't been
exposed to them via the visibleToInstantApps attribute.

Change-Id: I6fd78067d1253825668d67b9e17dd3a0703f5d57
Fixes: 35871716
Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest