Remove the signature protection for sensor privacy permissions

Only a couple distinguished packages will need to hold these
permissions. We can grant via role for these cases.

Previously system ui was started assuming the system server was
initialized enough but the problem was that the role service may not
have finished granting all permissions. If we start sys ui after system
services have finished onUserStarting then we can _probably_ safely
assume the state of user 0 is initiallized.

Test: Wipe & reboot; dumpsys package com.android.systemui
Test: atest SystemUiTests
Bug: 184303952
Change-Id: I160ac8e0f2fbc36a76e8f2ee99d73e613ddc3c11

services/java/com/android/server/SystemServer.java

@@ -2724,13 +2724,6 @@ public final class SystemServer implements Dumpable {
                 t.traceEnd();
             }
 
-            t.traceBegin("StartSystemUI");
-            try {
-                startSystemUi(context, windowManagerF);
-            } catch (Throwable e) {
-                reportWtf("starting System UI", e);
-            }
-            t.traceEnd();
             // Enable airplane mode in safe mode. setAirplaneMode() cannot be called
             // earlier as it sends broadcasts to other services.
             // TODO: This may actually be too late if radio firmware already started leaking
@@ -2932,6 +2925,14 @@ public final class SystemServer implements Dumpable {
             }
         }, t);
 
+        t.traceBegin("StartSystemUI");
+        try {
+            startSystemUi(context, windowManagerF);
+        } catch (Throwable e) {
+            reportWtf("starting System UI", e);
+        }
+        t.traceEnd();
+
         t.traceEnd(); // startOtherServices
     }