[Telephony] Secure contact URI access in Call Forwarding

Enforce caller permission checks on the contact URIs returned by the
contact picker in CdmaCallForwardOptions and GsmUmtsCallForwardOptions.

A malicious third-party application acting as a contact picker could
return a specially crafted Enterprise URI (e.g., pointing to a protected
work profile contact) that it does not have permission to access. Due to
insufficient verification, the Phone app would query and display this
contact, leading to a cross-profile data leak (Confused Deputy).

This change:
- Validates that the calling application has explicit read permission to
  the returned contact URI using ComponentCaller.
- Adds defensive null checks for the contact URI after retrieval to
  prevent NullPointerExceptions in ContentResolver.query.

Bug: 490916793
Test: atest TeleServiceRoboTests:ContactPermissionUtilsTest
Flag: EXEMPT BUGFIX
(cherry picked from commit c640414ba5ec8279ec48ae1093baa3be5878d6bc)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:d617606a49b1a457b31e195b3b652ae21115ced7
Merged-In: Ib0ad34bffb9cb12e186ed8a0e605d11ae185e817
Change-Id: Ib0ad34bffb9cb12e186ed8a0e605d11ae185e817