Attach domain verification states during package scan/install

Handles adding a new package (either from a brand new install or a boot
scan) and migrating between packages when installing an update.

Will merge the package states in the update case to preserve successful
verifications while removing failed domains so that they can be
re-requested by the verification agent.

Exempt-From-Owner-Approval: Already approved by owners on main branch

Bug: 163565712

Test: manual, device boots, will be tested as part of later changes

Change-Id: I54dc8415e10544e618905e269ab95ec0a2af0fb0