sepolicy: allow system apps to access ASEC

Required for Settings to show name/icon of apps on sd card
(permission copied from untrusted_app)

Also removed duplicate permission (from domain) in untrusted_app

Change-Id: Ib2b3bee4dfb54ad5e45b392fd9bfd65add4a00bf
sepolicy: New type sdcard_posix for labeled filesystems

 * Need this because sdcard_external is an alias for vfat

Change-Id: I804ebb0fcf643d603b1a02ee7a54e6d5b6b46294