Add system/sepolicy/apex to bp2build allowlist

Technically, tzdata apex depends on
//system/sepolicy/apex:com.android.tzdata-file_contexts. Builds suceeded
regardless due to bp2build generating a filegroup for all files in a
directory.

This also requires an update to the check in apex/builder.go to address
the fact that outputs (including filegroups) from Bazel in mixed builds
will be in a Bazel out subdirectory. This change also corrects a
potential bug that would not support all subdirectories under
system/sepolicy as golang's path.Match does not treat ** as recursive.

Test: go test apex tests
Test: build/bazel/ci/mixed_droid.sh
Change-Id: I1076d60cf271e4cdd1ea990156ab0a39fcfa6535