sepolicy: allow system apps to access ASEC

Required for Settings to show name/icon of apps on sd card
(permission copied from untrusted_app)

Also removed duplicate permission (from domain) in untrusted_app

Change-Id: Ib2b3bee4dfb54ad5e45b392fd9bfd65add4a00bf
sepolicy: New type sdcard_posix for labeled filesystems

 * Need this because sdcard_external is an alias for vfat

Change-Id: I804ebb0fcf643d603b1a02ee7a54e6d5b6b46294
init: Fix datadata context migration

PackageManager/installd deal with the app data relabeling, but not
the dirs where the data is stored. Let init perform the relabel for
/data/(user|data)

Change-Id: I179df40deb62dc811f697cea65127522072be6eb