DO NOT MERGE: Enforce suspend restrictions in startOp and noteOp paths

Suspended apps could previously bypass AppOps restrictions by using the
startOp and noteOp code paths, as these did not check the package
suspended state. This change adds a check for isOpRestrictedDueToSuspend
in noteOperationUnchecked, startOperationUnchecked.

Refactored FrameworksServicesTests to verify these restrictions. The
tests now independently check checkOp, noteOp, and startOp paths.

Bug: 477935679
Test: atest FrameworksServicesTests:SuspendPackagesTest \
          CtsSuspendAppsTestCases:SuspendPackagesTest
Flag: EXEMPT CVE_FIX
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:b08cc8a4ed6d364feb32340422fe6afe4df37859
Merged-In: Ifeac8cebdec2fb8d6129ecfdf18b4413303b62f4
Change-Id: Ifeac8cebdec2fb8d6129ecfdf18b4413303b62f4