Merge "Allow only selected priv apps to run OOB" into pi-dev