Allow forward locked apps to be in ASECs

We couldn't put forward-locked apps in ASEC containers before since we
didn't have any permissioned filesystems. This adds the ability for
forward-locked applications to be in ASEC containers.

This means that forward locked applications will be able to be on the SD
card now.

This change also removes the old type of forward-locking that placed
parts of apps in /data/app-private.  Now all forward-locked applications
will be in ASEC containers.

Change-Id: I17ae0b0d65a4a965ef33c0ac2c47e990e55707ad