Enforce a default policy on packages without <overlayable>

In order to lift the signature/preinstalled install restrictions on overlays,
we must protect packages that have not migrated to <overlayable> from
being overlaid. If a resources is not specified as overlayable and the
overlay does not define an <overlayable>, require the overlay to be
preinstalled or signed with the same signature as the target.

Bug: 121016681
Bug: 125933494
Test: idmap2_tests
Change-Id: I38f520929031b743e4bbe0366a9be55aac5795c5