sepolicy: allow bootstat to query health HAL

[pbzin]

What changed

• allow bootstat to use Binder
• make bootstat a client of the Health HAL

Why

crDroid's system/core commit 18208b05e changed bootstat to query
android.hardware.health.IHealth/default through
AServiceManager_checkService() and then call getHealthInfo().
system/sepolicy was not updated with the corresponding Binder and Health
HAL client policy.

On an enforcing Android 16 boot this produces:

avc: denied { call } for comm="bootstat"
scontext=u:r:bootstat:s0
tcontext=u:r:servicemanager:s0
tclass=binder permissive=0

Without access to the Health HAL, bootstat cannot retrieve the battery level
used by its factory-reset metrics.

Validation

• reproduced the Binder denial on an SELinux Enforcing Android 16 build
• confirmed the current 16.0 policy lacks both relationships
• git diff --check passes
• uses the standard binder_use() and hal_client_domain() macros rather
  than adding direct broad allow rules