Prevent start if package is frozen

Because process start is broken up into the blocking startProcessLocked
method and a handler that then later actually starts the process, we
were failing to block launch of frozen packages (being updated) that
happened to have their request to start take place just before they were
frozen.

This change leaves in place the check for frozen state in the blocking
method, but adds another to isProcStartValidLocked to ensure that a the
actual time of process start we check frozen state again. The side
effect of this is that in the case that the process is started in the
window described above, the caller will not encounter the
SecurityException, but it's more correct that we don't launch an app
while it is being actively updated.

Test: None; difficult to reproduce.
Bug: 150303575
Change-Id: Iea24c9b1c937c699f6df13f4ea742905354d664f