More flexible API enforcement policy.

This CL adds the basics to set black, dark gray or light gray list
enforcement, rather than just black as before. It's not possible to
actually set the policy per-package yet.

PackageDexOptimizer still uses a single bit, for API checks on/off, rather
than the new enum. It assumes blacklist enforcement internally. This can
be improved in a follow up CL.

Test: m
Test: Boot device

BUG: 73337509
Change-Id: I582bbb3ae63b4ef1c1f2af78930d153df7936075