policy: Allow any inactive user to refresh the package cache as well

This works around a flood of permission dialogs on RDP connections, and
generally should be a safe change to make (apt(cc) protects against
excessive use).