[AppWidget] Strip URI grants in ConfigActivityProxy

AppWidgetConfigActivityProxy is a system-privileged activity that
relays the result of a widget configuration activity back to the
host. Since the proxy's PendingIntent is created by the system,
calling setResult() with an intent containing URI permission grant
flags would cause the system to grant those permissions to the
caller. This allows a malicious widget provider to trick the system
into granting it unauthorized URI permissions.

This change strips the URI permission grant flags from the result
intent before calling setResult() in the proxy activity. This
ensures that no URI permissions are inadvertently granted by the
system UID.

Bug: 498916138
Test: atest FrameworksCoreTests:android.appwidget.AppWidgetConfigActivityProxyTest
Flag: EXEMPT BUGFIX

Autogenerated by MendIt (go/androidmendit)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:e2c75d70260ad97f24feef6b8ec1a0ebfe364347
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:80e84dab91f60a4c7175759802b30d4ad3241c39
Merged-In: I770b26d0e28e1090abae452e3bc00af51bf9b30e
Change-Id: I770b26d0e28e1090abae452e3bc00af51bf9b30e