Set up fs-verity in system_server process

fs-verity setup no longer needs CAP_SYS_ADMIN, so move the setup into
system_server to avoid extra hop to installd.  The old path still needs
to be kept for legacy mode unfortunately.

Merkel tree is now also built in private memory instead of shared
memory.

Test: adb install foo.apk
Test: adb install-multiple foo.apk foo.apk.apk_sig
Bug: 112037636
Change-Id: I5c7ac50052fdb242aa60c8eadf97c24a1655b006