Fix all runtime permissions being considered changing protection from

non-runtime on first boot.

1. Don't check against a newly created permission object, as it will
always have signature protection and be considered non-runtime.

2. "Placeholder" permissions of TYPE_CONFIG shouldn't count as an
existing permission, as they are only used for assigning GIDs.

Bug: 183304624
Test: manual
Test: atest PermissionEscalationTest (from ag/12980961)
Change-Id: I39055a914a8575c754a3a4def2b2a31071605986