Support extra checks for ErrorProne in a dedicated property

Previous extra checks for ErrorProne were added using the plugins
proeprty to get them into the -processorpath argument.  This works
fine for java-only modules, but fails for mixed java+kotlin modules
because the processorpath is given to kapt and not javac.

Add a dedicated errorprone.extra_check_modules property (mirroring
the lint.extra_check_modules property), and add that to a separate
processorpath that is used only for errorprone rules and not cleared
when kotlin is used.

Test: TestKapt/errorprone
Change-Id: Id6ef02ce758532d1df8b8d969fad83bb44fe93ab