Enforce bcp/sscp stubs do not compile against apps

This ensures that we do not run into circular depencies when
UNBUNDLED_BUILD_TARGET_SDK_WITH_API_FINGERPRINT=true. When this variable
is true, apps compile with a min_sdk_version equivalent to the sha of
the apis (i.e. the java_genrule `api_fingerprint`). If the api stubs are
allowed to depend on android apps, we will run into circular deps

Implementation details
1. Modify the deps mutator of combined_apis to add a dependency on the
   stub java modules
2. Do a graph walk in GenerateAndroidBuildActions and ensure that no
   child is an android_app. This will be determined by casting to
AndroidLibraryDependency.

Re (2): this does a graph walk via ctx.WalkDeps, but should not be
computationally intensive because
(a) We do this for a single module (i.e. combined_apis)
(b) The transitive closure is shallow since it starts from stubs

Test: presubmits
Test: locally, added an app to libs of `service-sdksandbox` and verified
that the error is raised

Bug: 315016205
Change-Id: Iaf35f03171d13d75e75de6e0e744fcf34e3294fd