Forbid generating boot image files for jars in updatable modules.

This is to guard against the potential situation when someone adds
updatable modules to the list of boot jars by mistake.

Test: aosp_walleye-userdebug builds.

Test: Manually break the checks and observe the errors:
  - move updatable module 'conscrypt' from
    PRODUCT_UPDATABLE_BOOT_JARS to ART_APEX_JARS:
      internal error: module 'conscrypt' from updatable apex 'com.android.conscrypt' is not allowed in the ART boot image

  - add updatable module 'conscrypt' to ART_APEX_JARS
    (but do not remove it from PRODUCT_UPDATABLE_BOOT_JARS):
      error: A jar in PRODUCT_UPDATABLE_BOOT_JARS must not be in PRODUCT_BOOT_JARS, but conscrypt is.

  - move updatable module 'framework-tethering' from
    PRODUCT_UPDATABLE_BOOT_JARS to PRODUCT_BOOT_JARS:
      internal error: module 'framework-tethering' from updatable apex 'com.android.tethering' is not allowed in the framework boot image

  - add non-updatable (in AOSP) module 'android.net.ipsec.ike'
    to PRODUCT_BOOT_JARS:
      internal error: failed to find a dex jar path for module 'com.android.ipsec.ike', note that some jars may be filtered out by module constraints

Bug: 147579140

Change-Id: I25ca2f52530fcfa1f9823b2cfa3485db9c0d0db1