Change PRODUCT_CFI_INCLUDE_PATHS to opt-out (Make)

This CL changes PRODUCT_CFI_INCLUDE_PATHS to be included in all
product configs by default. To maintain the status quo, the sanitizer
logic has been modified to only respect this product config for Arm64
devices (where this was previously enabled).

Bug: 63926619
Test: m -j60 # the device still has CFI enabled thanks to the default
opt-in

Change-Id: I22788d92be881d3290568488f5458c85e02ee8c7