ensure that privapp_allowlist is installed before android_app

AndroidMk assumes that the app is the last file installed, and it uses
this assumption to populate the LOCAL_SOONG_INSTALLED_MODULE entry. This
CL moves the privapp_allowlist installation to before the app
installation to respect this assumption.

Bug: 242509786
Test: go test
Test: OUT_DIR=out.ref m nothing &&
  cp aosp/2562351 && OUT_DIR=out.change m nothing &&
  GOWORK=$PWD/build/bazel/mkcompare/go.work \
  go run android/bazel/mkcompare/cmd -json \
  <(sed -e "s/out\.ref/out/g" out.ref/soong/Android-aosp_cheetah.mk) \
  <(sed -e "s/out\.change/out/g" out.change/soong/Android-aosp_cheetah.mk)
  && verify manually that the only diffs are related to the removal of
  the prebuilt_etc module.
Change-Id: I95ec27070f575e79fb976de68493a219717ed89a