If ENSURE_VERIFY_APPS is enforced, reject installation by default.

Bug: 37738016
Bug: 37737479
Test: manually, tried to install a package when the user is still locked on an FBE device and hence verifier doesn't run as it is not crypto-aware.
Change-Id: I6d9d5dd13c8ebd49cc8e5e3381d1a04eb54f1747