Block non-activity notification trampolines for apps w/ targetSdk S+

Block activity starts coming from broadcast receivers and services in
response to notification and notification action clicks for apps that
target SDK S+.

Note that for those cases (the ones that are being blocked), I'm always
showing the toast.

Also move SAW check to before the process flag check so we don't show
toast/log false positives (apparently I missed this).

Bug: 167676448
Test: atest NotificationManagerTest
Change-Id: I3d8124ca66718a9726121ff65e519cdcf349b214