Final changes to protect the API surface

This is it. The last set of changes to protect instant apps
from full apps.

Bug: 35871369
Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest
Test: Manual; install instant app and ensure it runs
Change-Id: If71385bcc9a5637590fbd99b0ffcd5ed8809509c