Only sync adapters with access can see an account - framework

It was possible for a sync adapter without accounts access to
see the account which it is supposed to sync which can be used to
identify the user. This change ensures that only sync adapters
with account access can run (which results in seeing the account),
otherwise we involve the user to approve access only to this account.

A sync adapter can access an account if one of these is true:
 - it is signed as the authenticator for this account
 - has the GET_ACCOUNTS permission
 - has an auth token for the account
 - it is a preinstalled app (system or privileged)

The main thing we need to figure out is if the extra prompts
for giving access to a sync adapter to the account create too
much friction.

bug:28163381

Change-Id: Ie083bb681b5a2aed81ca5f6a062193a175fad77e