Fix domain approval level constants

While it doesn't really matter, since Settings will soon deprecate the
legacy levels, technically ask and always are supposed to be separate,
so that always takes precedence.

Bug: 182520997

Change-Id: If12382c3d106c1330a20b708de4cccdc9c028232