check-flagged-apis.sh: use correct path to generated API signature files

The path to the generated API signature files used with --api-signature
in the check-flagged-apis.sh script are different based on the lunch
target used: sometimes it's under $ANDROID_PRODUCT_OUT, other times
under out/target/product/mainline_x86.

Teach check-flagged-apis.sh to dynamically find the correct path by
querying ninja.

Bug: 334870672
Test: croot && build/tools/check-flagged-apis/check-flagged-apis.sh
Change-Id: I1b0b41ef3ad1bc7113a3b31323d81251e7e65933