Themes: Only process themes that are applied during boot

Currently, the PackageManagerService will process all themes and
ensure their resources are compiled and available to the system.
This is highly inefficient and can bog the system down when booting.

This patch will only process the themes that are currently applied
durring boot and lets the ThemeService take care of queuing up the
others for processing.   This reduces boot time considerably,
especially when the user has many themes installed.

Change-Id: I52168a1751ad3bfc458048dd1558ad71cc16317a
Augment SELinuxMMAC functionality.

* No longer support a package name stanza outside of
  a signature tag. Package names, by themselves, have
  no security associated with them in Android and thus we
  should not be allowing or encouraging this
  type of policy.

* Allow for nested package name stanzas inside
  signature stanzas. There are cases where a finer
  distinction needs to be made among apps signed with
  the same cert. New code allows a different seinfo
  tag to be assigned to the listed package names
  signed by the parent cert. When a determination needs
  to be made concerning seinfo assignments, the inner
  seinfo tag takes precedence over the outer seinfo
  labels which are assigned to just the signature.

* Temp structures are now used to parse new policy files
  until the entire xml file is parsed and deemed correct,
  at which time the temp structures are copied over to the
  permanent class structures. This ensures that any structural
  errors with the policy will not result in partial loads.

* Valid stanzas look like the following with the inner
  package piece being optional.

   <signer signature="">
     <seinfo value=""/>
     <package name="">
       <seinfo value=""/>
     </package>
   <signer>

   <default>
     <seinfo value=""/>
   </default>

Change-Id: Ia204d71211776dcf9b2dcc86ad6d77c4ad39dc25
Allow PMS to restorecon directories under /data.

This change applies a relabel to both /data/data and
/data/user directories on boot. Not every boot will
apply this relabeling however. The appropriate
seapp_contexts is hashed and compared to
/data/system/seapp_hash to decide if the relabel
should occur.

Change-Id: I05e8b438950ddb908e46c9168ea6ee601e6d674f
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Proper security labeling of multi-user data directories.

This patch covers 2 cases. When an app is installed
and the resulting data directory is created for all
existing users. And when a new user is created and
all existing app data directories are created for
the new user.

Change-Id: Iaba7c40645bc7b6cc823d613da0c3782acf6ddd5
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>