add KEYPHRASE_ENROLLMENT_APPLICATION permission

Split the model management permission controll into two separate
permissions. KEYPHRASE_ENROLLMENT_APPLICATION is reserved for enrollment
applications detected by KeyphraseEnrollmentInfo class while
MANAGE_VOICE_KEYPHRASES is reserved for VoiceInteractionService
implementations.

Keyphrase enrollment applications are allowed to enroll at anytime,
and VoiceInteractionService implementations are only allowed to enroll
when they are the active service (see VoiceInteractionManagerService).

Bug: 151405284
Test: Enroll voice model from both enrollment application and active
voiceinteraction service.
Change-Id: I12eeb09e308af9aa934174dd059f47f789a9ce39

Change-Id: Iffdfeab1d09ec6c8cf4b30a9768ef6efc9bdfa01