Encapsulate snap update permission operations in `PermissionController`

[rekmarks]

The SnapController.updateSnap() method performs some permission calculations that should occur in the PermissionController. In particular, it compares the permissions of an existing snap with that of a new version, revokes ones that no longer exist, and grants ones that were added. It accomplishes this by calling PermissionController actions. Ideally, these operations would be encapsulated within the PermissionController, while the approval request is managed by the SnapController.

[rekmarks]

This is likely to be fixed by #4163 and related work.