Add a separate read permission for oem unlock state

New privileged permission READ_OEM_UNLOCK_STATE added
for system privileged apps.

Changing the unlock state still requires the old
permission OEM_UNLOCK_STATE, which is signature protected.

Bug: 28953956
Change-Id: Iedd2ad1d2d1dc3ae91122d7c406e3ee623a47d61