Force verifying updated priv apps on boot if enabled

If ro.apk_verity.mode is non-zero (default 0), package manager
will force verifying updated priv apps in /data, and make sure the
certificate matches the original one in /system, which we trust.

Test: logcat shows force collecting cert only if enabled
Bug: 30972906

Change-Id: I33f98930aaaaf76dbe2c0bc664e841f7892eb00e