Restrict updates of system packages

By declaring a <restrict-update> tag in its manifest, a system package
can restrict its update to be the singular package that has the same
given hash. An update's hash is the SHA-512 across all its APKs [i.e.
for splits, the SHA-512 is calculated over the concatenation of the
base plus all splits].

The restriction only applies to system packages.

Bug: 28398205
Change-Id: Iec493fc8ef27edee53f1d437cb0caaa78782f329