Add a System API to block keys in KV restore

BackupManager#excludeKeysFromRestore can be used to pass a
list of keys that will be excluded from restore for the given package.
It is useful in situations when a key being restored can cause bad UX on
certain devices.

Bug: 145126096
Test: atest KeyValueRestoreExclusionHostSideTest
Change-Id: Ibbfd5e9196122c9bc3d31a3f0cc9430e433b9fd8