Add OBSERVE_ROLE_HOLDERS permission to shell.

This allows testing relevant APIs in CTS tests. The listener itself
only gives the changed role name and user affected.

Bug: 125404675
Test: build
Merged-In: I5c979a26dae103ea1b633c2119c59363d8953aa2
Change-Id: I29ca1827e597d318cbd74ba3e70796c5853a9dc4
1 file changed