Add a permission for CDM apps to start FGS from the background

Previously, any apps with a CDM association was allowed to start
foreground services from the background.

Now, only apps with
REQUEST_COMPANION_START_FOREGROUND_SERVICES_FROM_BACKGROUND
(or REQUEST_COMPANION_RUN_IN_BACKGROUND) are allowed to do so.

Bug: 186536261
Test: Manual test with a test app using CDM. With and without these
    permissions.
Change-Id: Ic00aa1c7cfefc37bf89ea3079ef0977aee12499b