Enforce isSystem for app-link SysConfig

Only apps that are preloaded on the system are allowed to be auto
approved. This prevents package name takeover for optional packages
that are still configured in the XML.

Bug: 166697328

Test: atest DomainVerificationPackageTest
Test: manual verify pm get-app-links on a device

Change-Id: Ic055db3c07ff876600402c3ed0fe66b30cebe09e