Declare apps of prebuilt_apex for apkcerts.txt

Make built apkcerts.txt currently creates entries for every app in the
tree. When this implementation was recently changed to be limited to
only the list of installed apps, it caused b/403528876. The reason for
this is that the signing process signs .apks inside .apex files as well.
This works fine for `apex` module type. It worked fine for
`prebuilt_apex` previously because it implicitly dependend on the global
nature of apkcerts.txt, i.e. that the source `android_app` will create
an entry for apkcerts.txt

In preparation to limit apkcerts.txt to the list of installed apps and
apk-in-apexes, introduce an explicit `apps` property in `prebuilt_apex`.

Bug: 399788149
Test: With RELEASE_APKCERTS_INSTALL_ONLY=true reapplied (https://r.android.com/3552561),
previously failed signing test now passes
https://android-build.corp.google.com/builds/abtd/run/L03300030010481704
Test: presubmits

Change-Id: Icd1e702b14e068fea0f08693e0e90e26d1ec27a2