Create optionalMinSdkVersion for <permission> in roles.xml

This way we have official support for a permission that's backported to
be grantable on older platforms.

This change is omitting the home role changes in ag/26383669 to minimize
potential impact.

This chagne is also incorporating ag/24977085 from main.

LOW_COVERAGE_REASON=b/326621383

Bug: 325470219
Fixes: 326338115
Test: mainline-presubmit RoleParserTest
Relnote: N/A
Change-Id: If4451f8b653010072ddf658178d7bdaa584e3c2d
Merged-In: If4451f8b653010072ddf658178d7bdaa584e3c2d
(cherry picked from commit f331d50f)