Annotate MLS trusted subjects and objects.

When using MLS (i.e. enabling levelFrom= in seapp_contexts),
certain domains and types must be exempted from the normal
constraints defined in the mls file.  Beyond the current
set, adbd, logd, mdnsd, netd, and servicemanager need to
be able to read/write to any level in order to communicate
with apps running with any level, and the logdr and logdw
sockets need to be writable by apps running with any level.

This change has no impact unless levelFrom= is specified in
seapp_contexts, so by itself it is a no-op.

Change-Id: I36ed382b04a60a472e245a77055db294d3e708c3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow system reset_uid, sync_uid, password_uid

Permits the system server to change keystore passwords for users other
than primary.

(cherrypicked from commit de08be8aa006c313e5025ba5f032abf786a39f71)

Bug: 16233206
Change-Id: I7941707ca66ac25bd122fd22e5e0f639e7af697e
isolated_app: Do not allow access to the gpu_device.

Bug: 17471434
Change-Id: I6fd1079be29a454f46ab84f0c43fcf816e679c98
Allow appdomain read perms on apk_data_files.

Address:
type=1400 audit(0.0:103): avc: denied { read } for name="arm" dev="mmcblk0p28" ino=195471 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir

(cherrypick of commit 711895db2897bc5d001899eb5e0f931c79a1ad3f)

Bug: 16204150
Change-Id: I8bf0172b26b780c110c0d95c691785143acd7dd2