Scaffolding: reject installs based on device fingerprint

Add the scaffolding for teaching the package parser to reject a package
if its manifest specifies a set of prefixes, and the device fingerprint
does not start with one of the prefixes.

Bug: b/232475788
Test: m
Change-Id: I9f3f3d3ad96332d2d65fbf6f58c7ce35992bcd7e