Add support for global cleartext penalties

* Add a global cleartext penalty setting and a system property. When set, apps cannot send/receive cleartext traffic and cannot allowlist themselves
* Change default policy from ACCEPT to INVALID. INVALID takes ACCEPT's functionality and ACCEPT is used to allowlist apps from cleartext restrictions
* Listen to changes to the setting, to package removals and to validated private DNS servers and set/remove cleartext rules accordingly
* Set global cleartext restrictions on boot
* Use an invalid UID, -1, to apply cleartext restrictions globally

Change-Id: Id9e5dc71b998de8fe124772dde6b82c7c1d4c1b6

Change-Id: Ie1a631dc574cc6f9039967e990d51ea5011f36fc
(cherry picked from commit bb52bb4de9d9de5eb08ea4f0344d63db13f065eb)