Share certificate bp2build between android_app and apex.

The certificate module is handled the same in Soong between android apps
and apexes, so share the bp2build code as well.

There are a few changes in this CL:

- If override_apex.certificate is unset, the generated apex also unsets
  it. This prevents the generated apex from using the base apex's
  certificate, which is most likely incorrect (e.g. google variant using
  the cert for the aosp variant). Instead, rely on the default
  certificate handling in the macro.
- If the certificate prop is a string, then it gets generated into
  certificate_name in order to disambiguate. This behavior is identical
  to android_app.

Test: added various unit tests.

Bug: 249089160
Fixes: 249089160
Change-Id: I99e18964ff546429a985d0f64dc21e2c69d35d9d