Include a list of used permissions in signed part of bundles

[jyasskin]

@slightlyoff mentioned that we might want to have third-party security reviewers check more or less stringently depending on which permissions an app uses. To do that, they'll need to be able to sign over the permissions they've checked for.