Check for downgrade and signature of outer .apex certificate

This logic is very similar to the one in StagingManager. We can look
into consolidating it in one place as one of follow up tasks.

Bug: 188713546
Bug: 187864524
Test: atest ApexManagerTest
Test: adb install --force-non-staged rebootless_v2.apex
Test: adb install pm list packages --apex-only -f
Change-Id: I12ff0ce121a349799062c76302de7c8f6407d8c2
Merged-In: I12ff0ce121a349799062c76302de7c8f6407d8c2
(cherry picked from commit 51903825)