Override apex manifest package, android_app_certificate and apex_key with product config.

- apex manifest package

The package name (not apex name) stamped into AndroidManifest.xml can be
overriden with PRODUCT_MANIFEST_PACKAGE_NAME_OVERRIDES, a
colon-separated list of apex:package_name mapping. For example,
test1_com.android.tzdata:com.google.android.tzdata means that
test1_com.android.tzdata's package name is com.google.android.tzdata,
and can be installed onto a device that has com.google.android.tzdata
preinstalled.

- android_app_certificate

The mapping for the certs used to sign APEX containers is similar to the
apex manifest package mapping, except that the certificates have to be
searched from the DefaultAppCertificate directory. For example,
com.android.tzdata:com.google.android.tzdata.certificate means to use
the Google certificate for signing the container.

This reuses the DefaultAppCertificateFiles filegroup added in a previous
CL for transition-safe product variable accessors.

- apex_key

This is used to sign the apex image (not container). While this doesn't
have a mapping like manifest package and app certificate, it is
influenced by product config as well.

apex_key overriding is simpler. It checks if DefaultAppCertificate is
set, and if so, look for the avbpubkey and pem in that directory.
Otherwise it uses the module dir or the testkey. See config#ApexKeyDir:

https://cs.android.com/android/platform/superproject/+/master:build/soong/android/config.go;l=980-990;drc=7a646211698cc713512bf5046b5bd3ba446143d1

Fixes: b/276416537
Fixes: b/275351675
Test: presubmit
Test: b build test1_com.android.tzdata, adb install onto internal cuttlefish device with com.google.android.tzdata5 preinstalled.
Test: apex key test
Test: abtd

Change-Id: Id9486c4436ea82f1a5ead12a09c198c0c2f7d085