Camera: allow appdomain FD use for hal_camera

The preview surface will run in app process and hal_camera will
need to wait on FD generated by preview surface.

Test: the denial is gone, able to take photo in
      messenger/hangout/drive application.
Bug: 35589980
Bug: 35485227
Change-Id: I1977174369b104617156065ff25203a17265b707

public/hal_camera.te

@@ -13,6 +13,8 @@ allow hal_camera ion_device:chr_file rw_file_perms;
 # Both the client and the server need to use the graphics allocator
 allow { hal_camera_client hal_camera_server } hal_graphics_allocator:fd use;
 
+# Allow hal_camera to use fence FD from surface owned by application
+allow hal_camera appdomain:fd use;
 
 ###
 ### neverallow rules