Block instant apps before domain verification filtering

Because domain verification itself filters instant apps, and isn't
aware of the allow instant apps toggle that PackageManagerService
holds onto, PMS should filter the set of ResolveInfo candidates before
DomainVerificationService gets them.

This way it can avoid resolving to an instant app that would later be
blocked and thus fail resolution entirely.

Bug: 180628950

Test: manual, see steps in bug

Change-Id: I37ba986bfafd26f6633ff1b6e355a76b4c92552c