Check for downgrade and signature of outer .apex certificate

This logic is very similar to the one in StagingManager. We can look
into consolidating it in one place as one of follow up tasks.

Bug: 188713546
Bug: 187864524
Test: atest ApexManagerTest
Test: adb install --force-non-staged rebootless_v2.apex
Test: adb install pm list packages --apex-only -f
Change-Id: I12ff0ce121a349799062c76302de7c8f6407d8c2