Implement permission check for virtualizationservice

For the service to be able to check permission, the AIDL interface is
exported to the virt APEX where virtualizationservice is in.

In addition, the VM permissions are granted to shell so that developers
can use the 'vm' tool on the shell.

Bug: 168588769
Test: /apex/com.android.virt/bin/vm run-app --log /dev/null
/data/local/tmp/virt/MicrodroidDemoApp.apk
/data/local/tmp/virt/MicrodroidDemoApp.apk.idsig assets/vm_config.json

Change-Id: I00db58ba9cef3b83f43db68ef86f062b59a0e6e1

core/java/Android.bp

@@ -277,6 +277,10 @@ aidl_interface {
     backend: {
         rust: {
             enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.virt", // for virtualizationservice
+            ],
         },
     },
 }

packages/Shell/AndroidManifest.xml

@@ -480,6 +480,10 @@
     <uses-permission android:name="android.permission.MANAGE_HOTWORD_DETECTION" />
     <uses-permission android:name="android.permission.BIND_HOTWORD_DETECTION_SERVICE" />
 
+    <!-- Permission required to run the `vm` tool which manages on-device virtual machines -->
+    <uses-permission android:name="android.permission.MANAGE_VIRTUAL_MACHINE" />
+    <uses-permission android:name="android.permission.DEBUG_VIRTUAL_MACHINE" />
+
     <application android:label="@string/app_label"
                 android:theme="@android:style/Theme.DeviceDefault.DayNight"
                 android:defaultToDeviceProtectedStorage="true"