Do not update packages in encrypted state

SystemServer used to run PMS.updatePackagesIfNeeded even when the
device is booting in encrypted state only with core packages
available. This is redundant because the packages are prebuilts
(OAT files always up to date) and the data partition is not mounted
yet, so we are only wasting time opening the OAT files and testing
checksums. Additionally, the attempt to update these packages gets
reported to TRON stats as time spent in the Optimizing Apps dialog
and skews the results.

This patch does not call updatePackagesIfNeeded when in the device
is in encrypted state.

Bug: 28833829
Change-Id: I8641d07a8840948ffe261dfb8f99f70de7341972