Creating new RESTRICTED bucket.

This new bucket sits between RARE and NEVER and will have more severe
restrictions than RARE. Jobs, alarms, background services, and more will
be affected. For now, we just create the bucket. Changes to the various
subsystems will be done in separate CLs. This bucket is not meant to be
used if the user has used the app recently, so there are safeguards in
place to make sure that doesn't happen. A new system-internal API is
added so it's easier to track internal calls and so that other
subsystems can provide explicit reasons for forcing an app into the
bucket.

Bug: 145551233
Test: atest AppIdleHistoryTests
Test: atest AppStandbyControllerTests
Test: atest UsageStatsTest
Change-Id: I8ae2e6fd2353111f6bcc176a5a1929551db01e0f