neverallow shell access to 'device' type

Bug: 65643247
Test: builds, the change doesn't affect runtime behavior.

Change-Id: I621a8006db7074f124cb16a12662c768bb31e465

private/domain.te

@@ -49,7 +49,6 @@ full_treble_only(`
     coredomain
     -fsck
     -init
-    -shell
     -ueventd
     -vendor_init
   } device:{ blk_file file } no_rw_file_perms;