Makefile: Add the payload public key into system image.

For non-Brillo devices using AB update, add the payload signing public
key to the system image
(system/etc/update_engine/update-payload-key.pub.pem).

We first need to sign the payload with some private key, and pack it
into an Android OTA package. Then the whole zip package will be signed
again with the device key. This is to comply with the two existing OTA
flows (Android and CrOS).

We use the same device key to do the two signings, but update_engine
expects the key in RSA public key format. This CL extracts the public
key from x509 certificate and adds it to the system image.

Bug: 25715402
Change-Id: I6f6c1148534250ddb6d9e554175c7a35bceda99e