Allow shared_relro to connect to activity_service.

The comment in the policy implied this was already the case, but it
wasn't actually being used and appears to have been removed. This will
now be required by a framework change, so actually add the rule to allow
it.

Bug: 19061358
Test: verify that WebViewLoader process doesn't die from selinux denial
Change-Id: Ib1ed9138a83660ae343e0b665cdfadccdd0c6c97