Use callback to run binder service to avoid race

The binder interface should always be managed by ServiceWatcher, and
shouldn't be exposed to the caller. Otherwise the caller could cache an
unbound service, and could cause system crash.

Bug: 69008332
Test: build and manual test
Change-Id: I70d1fe0bace7b0fb1c3844c2c9113b1fcf95f784