Restore security context of `/postinstall/apex` earlier in otapreopt_chroot.

Invoke `selinux_android_restorecon` on `/postinstall/apex` just after
mounting a tmpfs filesystem in it, so that this directory is correctly
labeled (with type `postinstall_apex_mnt_dir`) and may be manipulated
in following operations (`chmod`, `chown`, etc.) following updated
policies restricted to `postinstall_apex_mnt_dir` (instead of
`tmpfs`).

Test: m otapreopt_chroot
Test: A/B OTA update test (asit/dexoptota/self_full).
Bug: 113373927
Bug: 120796514
Change-Id: I0b243a00e0443e439afda055d3b12aa9eefe0503