Move PackageInstaller over to AppFuse.

When PackageInstaller was originally written, we needed a way to
ensure that untrusted apps were fully hands-off of any opened
FileDescriptors before we could proceed with certificate checks.

The best way to satisfy this security constraint was to build
a utility called FileBridge which was a (terribly slow) RPC
mechanism that could be cut off when needed.

However, a new feature called "AppFuse" offers to create a "proxy"
FileDescriptor which relays file operations back into userspace, and
it's much more performant than FileBridge.  (Local benchmark tests
that deliver a 64MB APK show that AppFuse is about 45% faster than
FileBridge.)  Because userspace is still involved in every operation,
we can still "revoke" access at any time to deliver on our security
requirements.

This change adds support for AppFuse, while keeping around FileBridge
as the default for now.  An upcoming flag-flip CL can be used to
easily switch between the two modes.

Test: builds, boots, benchmarking, stress tests
Bug: 35728404, 31332379, 25510838
Change-Id: I2a70c0ca922a5ba468ffdef7b2fd8ab79f7cfefd