Add visibility special casing for sdk sandbox

This change adds special visibility enforcement to the apps filter for
SDK sandbox uids. If we encounter an SDK sandbox UID, we'll bypass
traditional visibility checks and instead just enforce that the target
is forceQueryable. All else besides the client app will be blocked.

Test: atest AppsFilterImplTest
Bug: 234129698
Change-Id: Ic42d46232841294a0fd148e5f29d1ff5ec4261c8