Migrate plans to @SystemApi, evolve permissions.

We're not yet ready to commit to SubscriptionPlan as public API, so
relax to be @SystemApi instead.  Add a new MANAGE_SUBSCRIPTION_PLANS
permission that we require apps to hold, unless they've been
delegated access via a trusted CarrierService.

Since several apps have the ability to provide plans for a single
subId, we now remember the "owner" who set the current plan
information, and we refuse to leak plan information beyond the app
that originally set it.

Relax permissions check to not require READ_PHONE_STATE, since we're
only returning data that an app provided to us earlier.  Also fix
NPE when SubscriptionInfo is missing.

Test: bit FrameworksServicesTests:com.android.server.NetworkPolicyManagerServiceTest
Bug: 63997177, 63928277, 64156138, 63903381
Change-Id: If503378ef406dcaec438c9b41e837e0a821a3ef4