Support reading block apexes from system_server

This relaxes the neverallow so that it is possible to write a new
SELinux allow for system_server to read /dev/block/vd*. It still isn't
possible unless a vendor enables it.

Bug: 196965847
Test: m -j
local_test_runner arc.Boot.vm

Change-Id: Idad79284778cf02066ff0b982480082828f24e19
1 file changed