Use a single otapreopt_chroot invocation for all otapreopt runs.

Instead of taking the dexopt command on the command line it reads a
sequence of commands from stdin.

Since this change revamps the interface between the script and the
chroot binary, and also requires an sepolicy change, OTA packages with
this change won't work with older system images.

In that case we just give up and don't preopt anything. Since T
(Android 13) there's no blocking at boot reverifying all packages (the
old vdex'es are still used, even though the boot classpath has
changed), so the effect of skipping OTA preopt is much less severe than
it used to be.

It's possible to provide a compat mode in the script for the old
otapreopt_chroot binary, at the cost of one invocation per package.
That's not done here since dex2oat still won't work correctly with the
sepolicy in such system images (b/291974157).

In a local test on Cuttlefish this reduces the OTA dexopt time with
about 1.5 seconds per package.

Test: Manual OTA where the system image and the OTA package are built
      with the change, then run DexOptOtaTests.
Test: Manual OTA where only the OTA package is built with the change,
      then check that the postinstall script exits early.
Bug: 293639539
Bug: 291974157
Bug: 199756868
Change-Id: Ie4e29beaee398428680a0c003f7cb01f2cdd76f9