Do not verify APKs out of updated APEXs

For APK-in-APEX the system is not aware of the pre-installed APKs. Hence
the currently installed APK always shows up as "factory-installed APK".

For factory installed APKs we enforce that all privilidged perissions
are manually whitelisted.

If an APK-in-APEX gets updated the app might request additional
privilidged permissions. We now explicity allow this.

This change leaves all apex specific logic inside of ApexMgr. E.g.
- how to figure out if a pkg is a apk-in-apex
- how apexPkgs are marked as factory/updated

Fixes: 148853593
Test: Built a new APK-In-APEX that contained new priv permission,
      installed it and rebooted -> no crash, but permission was not granted
Change-Id: I254e5189909efdafe3dc0ca8a5ab5a520457c585