Expose starting_at_board_api to access_vectors

It is useful to call the starting_at_board_api macro in access_vectors,
when a new permission is added.

Update the order expected by Soong for the build files to accept
flagging_macros as the first entry (once processed by m4, it is expected
that this file only contains comments).

Guard the recently added checkpoint_restore and bpf permissions behind
the starting_at_board_api macro.

Test: build
Bug: 353121021
Change-Id: Ic26af97aa0c99e4166e993900e1645a7709d7904
diff --git a/private/access_vectors b/private/access_vectors
index 7a280c5..9d82ac8 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -139,8 +139,8 @@
 	block_suspend
 	audit_read
 	perfmon
-	checkpoint_restore
-	bpf
+	starting_at_board_api(202504, `checkpoint_restore')
+	starting_at_board_api(202504, `bpf')
 }
 
 #