Transition mediacodec to /dev/hwbinder and /dev/vndbinder

This change disables /dev/binder access to and by mediacodec on
full-Treble devices.

b/36604251 OMX HAL (aka mediacodec) uses Binder and even exposes a
	   Binder service

Test: marlin
Change-Id: I1e30a6c56950728f36351c41b2859221753fd91a
Signed-off-by: Iliyan Malchev <malchev@google.com>

public/mediacodec.te

@@ -8,7 +8,14 @@ typeattribute mediacodec mlstrustedsubject;
 # and use macro hal_server_domain
 get_prop(mediacodec, hwservicemanager_prop)
 
-binder_use(mediacodec)
+full_treble_only(`
+    # on full-Treble devices, route all /dev/binder traffic to /dev/vndbinder
+    vndbinder_use(mediacodec)
+')
+not_full_treble(`
+    # on legacy devices, continue to allow /dev/binder traffic
+    binder_use(mediacodec)
+')
 binder_call(mediacodec, binderservicedomain)
 binder_call(mediacodec, appdomain)
 binder_service(mediacodec)