Add OTA support to mainline_system.

update_engine applies an OTA, and update_verifier verifies
partitions post boot.

Note that this also adds cacerts_google as it's a required module by
update_engine, so this reduces the disparity between pixel /system
and mainline_system /system by ~100 files.

Bug: 110410711
Bug: 111495787
Test: make
Change-Id: Idd31407bbd5543fe1dd2b52e87894ac501a025df