Add permission for instant apps creating foreground services

Foreground services could potentially be abused to get around the
lifecycle requirements of Instant Apps, so limit that behavior with a
perission that will need to be granted by the installer.

Test: Manually verified
Change-Id: Ia162077971e914960ebdb8293a33faa8038ed850