RESTRICT AUTOMERGE Prevent non-admin users from deleting system apps.

This addresses a security issue where the guest user can remove updates
for system apps.

With this CL, attempts to uninstall/downgrade system apps will fail if
attempted by a non-admin user, unless the DELETE_SYSTEM_APP flag is
specified.

This is a fixed version of ag/17400663, to address b/236578018.

Bug: 170646036
Test: manual, try uninstalling system app update as guest
Change-Id: I5eab215cba6528aa4316ed7b20bee544915c1486