convert android_app certificate property, bp2build

The android_app certificate property can be converted to the
@android_rules debug_signing_keys attribute in Bazel after converting
the .pk8/.pem key pairs to a JKS keystore in Starlark.

Test: b build -s //frameworks/base/tests/appwidgets/AppWidgetHostTest
  and verify includes SignApk action with generated keystore
Bug: 194133023
Change-Id: I2c4276f94a7856fc68a7674e89742f887dca31b4