Enforce that sdk sandbox may only bind/start allowed services

Integrates with an in-process API in SdkSandboxManagerLocal, which
enforces that a service may only be bound to or started by an SDK
sandbox uid if it is explicitly allowlisted.

Test: atest SdkSandboxManagerUnitTests
Bug: 209770510
Change-Id: I8da1b8f5f97b199a9500736c3fd44194a7c6813e