Enforce that a PendingIntent has an explicit mutability

flag on creation.

This was previously a log.e, this change enforces this requirement
except when an app is under instrumentation.
See go/immutable-pendingintents for more context.

Bug: 160794467
Test: atest PendingIntentTest
Change-Id: I6506dd311f2e440ad74fdf4f5aa447ea471a02f4