Fix issue #37360626: Apps can schedule alarms (and other things) with temp whitelist

There is now an IBinder "token" that must be specified when setting
the whitelist duration for an Intent.  To have the whitelist supplied,
the caller to send a PendingIntent must pass in the same token.  The
PendingIntent and IntentSender classes now internally maintain this token
to pass in when their send() is called.

The big complexity for making this work is we now need to associate this
whitelist token correctly with the actual PendingIntent objects that
applications and other code is getting.  To do this, we propagate the
token in the Notification object, and have a new API on Parcel that allows
us to make it available to PendingIntent when it is unmarshalled.  And
this allows to deal with PendingIntents appearing in nested bundles, as
we can propagate that information from the original Parcel to the new
Parcel that Bundle keeps to delay unmarshalling.

Test: manual
Change-Id: Idda00490ccfe2be37e4ab21354b9ab7528a52750