Allow only HotwordDetectionService to note OP_RECORD_AUDIO_HOTWORD

These ops do not incur the mic privacy indicator. The
HotwordDetectionService runs in a sandbox, so it's fine to allow it to
access the mic without notifying the user. Other clients that use the
hotword audio source will have their ops downgraded to OP_RECORD_AUDIO
(particularly the non-sandboxed partner to this service in the assistant
app - the VoiceInteractionService).

Bug: 186164881
Bug: 189967066
Test: manual - privacy indicator works as expected
Change-Id: Id55a4fdcd0b8edfda3b969302542fc6009da3395