Add OBSERVE_ROLE_HOLDERS permission to shell.

This allows testing relevant APIs in CTS tests. The listener itself
only gives the changed role name and user affected.

Bug: 125404675
Test: build
Change-Id: I5c979a26dae103ea1b633c2119c59363d8953aa2
1 file changed