Block SAF directory access to /sdcard/Android

This works for target R+ apps, but need to come up with a better story
for target <R. The enforcement in DocumentsUI is target SDK based
and those apps bypass the block_tree flag.

Bug: 157320644
Test: atest DocumentsTest
Change-Id: I93aea7cd5d3b7befea1f78e1cf3f31f8250f1d33