Implement two-phase rollback (4/n)

Reduce the chance of rolling back Mainline udpates which might
contain critical security fixes.

It works as:
1. roll back only rebootless apexes if they are available
2. if native crash stops, we are good again
3. if not, roll back all remaining rollbacks
   which is the best we can do

Bug: 195517333
Test: atest StagedRollbackTest
Change-Id: If938d7f9f17957ab30d71d2cc87a148c07dd3da7