Refactor "staging dep on prod" allowlist dep

This allows branch-specific plugins to more easily add modules to
staging or prod mode allowlists (they need not separately ensure that
staging mode is a superset of prod mode)

Bug: 254447469
Test: TH
Test: Verified that adding tzdata modules via plugin (not part of
this CL) causes many outputs under bazel-out directories

Change-Id: I5d543e262a42cce324c59e3f9880b57ca209c13c