sepolicy: Allow SurfaceFlinger to read from /data/local/tmp