New permission for Device Management Role Holder

MANAGE_DEVICE_POLICY_QUERY_SYSTEM_UPDATES gates
DevicePolicyManager.getPendingSystemUpdate. Give
this permission to the DMRH so it can query pending
OTA on the device.

Bug: 254653320
Bug: 289520697
LOW_COVERAGE_REASON: TRIVIAL_CHANGE
Low-Coverage-Reason: TRIVIAL_CHANGE
Test: android.permissionpolicy.cts
Change-Id: Ic2d27fdabc5b02016c8586f444151f92ea81faf6