Forbid updatable: true on vendor APEXes.

Vendor APEXes do not formally support updates outside of the main OTA
process. We should clarify this at build time.

Test: set vendor apex to updatable, observe failure
Test: apex_test.go
Change-Id: Ife8d242a42415ebf00d7dced72c07cda1fde1839