Require targetSdk >= O for ephemeral installs

This ensures that platform and security features that are gated by
targetSdk are all enabled for ephemeral apps.

Test: adb install --ephemeral succeeds for CUR_DEVELOPMENT, fails for
N_MR1

Change-Id: I41b9ccc4995ba07d9a0c11b2918fa24c71892330