Enforce sysui-held permissions when getting main launch intent

- Because a mutable pending intent is returned, we actually do need to
  enforce that SysUI is the only caller of this method

Bug: 278881947
Bug: 253216640
Bug: 256590334
Test: atest LauncherAppTests

Change-Id: I89dd6891a826f934a247881c6dd9ec5cacf2d082