allow prebuilts to specify LOCAL_CERTIFICATE so they can be resigned

If a prebuilt specifies a LOCAL_CERTIFICATE, stick it in the
PACKAGES.* collection so that the predexopt process can work on the
file (which only works if the new .apk can be signed).