[sandbox] Document "system" policy key

The "system" key in a sandbox policy provides read-only access to the
system package. This key is needed by some applications that read
information from the system package but don't themselves need to be part
of the system package. We might remove this feature in the future if
pkgfs can satisfy all these use cases (e.g., enumerating the available
command-line binaries).

Change-Id: I6b5835f4c85aa60311a4e21508b953fdc9ff9920