Fix PrinterSpooler D-Bus signal spoofing

[oubayashi]

The existing policy grants root permission to send messages on the
com.redhat.PrinterSpooler interface, but does not deny unprivileged
clients. Since the system bus permits broadcast signals by default, an
ordinary user can emit a spoofed PrinterSpooler signal despite the
comment claiming that only root can send it.

Deny signals on this interface in the default policy and allow them
again for root. This preserves reception for all connections and limits
the change to signal messages, avoiding an unintended restriction on
other message types.

[oubayashi]

I was able to reproduce this locally with a regular, non-root user.
Even though cups.conf says that only root can send the message, the
following command succeeds and is visible to listeners:

dbus-send --system --type=signal /com/redhat/PrinterSpooler com.redhat.PrinterSpooler.PrinterAdded string:fake

It looks like the current rule only allows root, but does not explicitly
deny anyone else. Since the system bus allows broadcast signals by
default, regular users can spoof these notifications too.