Allow apex to use generated file_contexts

To support trunk stable, file_contexts files should be processed before
creating APEX images. That means that file_contexts may be under out/.
This change relaxes the path check so we can use Soong-generated
file_contexts, not only the real source file_contexts. Of course the
restriction that modules should be under system/sepolicy is still
enforced.

Bug: 306563735
Test: build with generated file_contexts; see virt apex
Change-Id: I3aa368b338141d4826fc8622e1c8d2838bfd8484