Only collect APK certificates for system apps after OTA

Tweak to ag/4642341 to reduce boot time impact.

Bug: 112482814
Bug: 80093599
Bug: 74501739
Test: Manually 'faked' an OTA by switching slots between two builds with
some apps installed. Verified only system apps got the forced
certificate rescan.

Change-Id: I987cf721e118297b1c40df92cc35e75830a7659c