Merge "Allow per-package exemptions for restricted AppOps" into nyc-dev