Restrict access to background networks to CHANGE_NETWORK_STATE.

When a network goes into the background, tell netd to set the
network's permission to NETWORK. Also, close all TCP sockets on
that network, to prevent long-lived TCP connections from staying
on it and possibly continuing to use metered data.

Bug: 23113288
Change-Id: Ie89c1940b6739160e25c6e9022b8b977afb3e16e