GitLab

When enforcing various storage permissions, check associated app-ops
to see if they've been revoked.  We're okay throwing outright, since
Environment already told the app that volumes are unmounted, so they
have no business poking around.

Read/write sanity checking should only be relaxed to group-level for
files living on storage devices; continue using globally readable
flags for all other files.

Refresh storage paths whenever volumes change.

Bug: 22718722
Change-Id: I8640998f490550b4cd3a9b27bb6cb1a658bd102a