Generate android_certificate_directory

Previously, partners were required to add an
android_certificate_directory filegroup in their certificate
directories, and allowlist that BUILD file. Now, we generate the
filegroup automatically.

We're using a different name, generated_android_certificate_directory,
to avoid conflicts with already-checked-in filegroups.

Bug: 285777389
Test: b test //build/bazel/rules/apex/...
Change-Id: Ib1bde487acd79d58368faf0aad02ded0bcdaceb4