Support minSdkVersion for <permission-set>.

It's now supported on both the initial definition, and the references
to it later.

Since the permission sets are macro-like and don't appear in the final
parsed role definitions (only the permissions they contain appear
there), the minSdkVersion is also applied to the permissions they
contain during parsing.

This way the final list of permissions associated with the parsed role
is always directly accurate, which simplifies the granting logic and
also makes any potential manual inspection easier.

Fixes: 303894242
Test: presubmit
Change-Id: I057d87ea04dbde1311dbab77e877fd43e4e15fb4