Enforce carrier privileges when setting/clearing VCN configs

This change ensures that only carrier-privileged apps can modify VCN
configs.

Since carrier privilege is checked per-subId, we iterate through all
subIds in the group, and check if any of them grant the calling app
carrier privileges.

Bug: 165670724
Test: New tests added, passing.
Change-Id: Iac032136d9c1975e6b95a2d2ad9b811ce45c9a53