aconfig: require exactly one bug field

Some consumers of `aconfig dump` do not support multiple bugs. At the
same time, we want all flags to be associated with at least one bug.

Teach aconfig to require that the bug field in the flag_declaration and
parsed_flag proto messages appear exactly once.

This change could have been implemented as a change of `repeated` to
`optional` in the proto definition. However, the chosen approach, with a
runtime check, is easier to revert if we want to support multiple bugs
in the future.

Bug: 293156797
Test: m all_aconfig_declarations && printflags
Test: atest aconfig.test aconfig.test.java aconfig.test.cpp
Change-Id: Ib87dac68b392986a8daa64e56cd85477c92fbe83