Move apex-update-allowed check

1. Move the check into PackageSessionVerifier
2. Fix a bug that the check doesn't work for multi-package sessions
3. If reboot happens before running this check, it will be run on
   next boot.

Bug: 213097119
Test: atest StagedInstallInternalTest
Change-Id: I92c44688be21498c11b6f7cf0dccfd3aabea0ba2