su: Appops integration

Initial support for an app-ops based allow-chain.

Change-Id: Ie5c6865e1772f7127f10dbd8f68e2fe930fa0407