Filter instant <--> full app

Last in the series for protecting full apps from instant apps. Still
need to make another pass at the opposite direction.

Bug: 35871369
Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest
Test: Manual; install instant app and ensure it runs
Change-Id: I3734cb154e7b952f3a9cf7c5415dffcd4de02aba