Add NETWORK_BYPASS_PRIVATE_DNS permission

Have the captive portal app and the MMS service use this new permission
to bypass private DNS.

This cherry-pick does not have the TODO and #SystemApi comments
deemed unnecessary in the original change.
Bug: b/78494660
Test: manual: captive portal login works
Merged-In: I0d3429faddc0509781c896608039e4143cb1e8fd
Merged-In: I77bec89592c594392e94da001f1e3992543b23ec
(cherry-pick of I0a4a8d0105becf6957fd44099bd84eca51e6716f, manual merge)

Change-Id: I041d123ccd9bb1af730a97707cce9003b552cffa