Assert executable content (mostly) only loaded from /system

Add a compile time assertion that most SELinux domains don't
execute code from outside of the system partition.

Exceptions are listed in the neverallow rule.

Change-Id: I8166e29a269adca11661df3c6cda4448a42ca30d