Add ROLLBACK past signing cert capability.

Add a new capability that may be granted to past signing certificates
after changing to a new signing certificate that will allow applications
to go back to a previous signing certificate.  This capability is
intended to not be granted, but may be added later in the event that
a signing certificate change caused undesirable behavior.

Bug: 73927694
Test: PkgInstallSignatureVerificationTest
Change-Id: I7453a2da00e740a55de45e7b144f308a9bc33772