Fix querying of multiple subtypes

Previously only the subtypes of the last registered listener would be
included in the discovery queries.

This fixes that by combining the subtypes of all registered listeners,
to be included in the queries. By moving the queried subtypes from the
QueryTaskConfig to the QueryTask, they are now recalculated before each
send (like the existing servicesToResolve), so are always in sync with
the registered listeners.

Fixes: 322918399
Test: atest
Change-Id: I9a4c94189f997e3a9f92e46b5eb1762e9925cf4c