Make CheckOp return allowed if any attr tag for a package is excluded

checkOp doesn't support checking against an attribution tag, this causes
some checkOps to fail when a noteOp is successful meaning that a
preflight routine might fail before delivering data and doing the more
precise check. This only affects when a user restriction is applied and
there are excepted package+tag.

Test: Checkop with test app
Bug: 232502990
Change-Id: Idcf5ac9a5401ad8089f5873da1f978fdf9258b5a