Allow shared users to rotate signing certs in an OTA

As part of an OTA we allow system applications to change their signing
certificates however in order to fully support rotating signing certs in
an OTA we must also be able to rotate the sytem shared users to new
signatures.

Bug: 74501739
Test: rotate keys and adb sideloaded update, device now boots
Change-Id: Ic04f1d3dbbe1da6ee723addc9be048f92440dda0