Check signature policy in IdmapManager

This uses the same logic as PackageManager, where all signatures
in the overlay package must match those in the target package
exactly.

Test: passes for platform overlays, actual functionality tested by
idmap2_tests

Change-Id: Icb0f275353f6ed48d1a1297672c85c04a6120cd0