Require targetSdk >= O for ephemeral installs

This ensures that platform and security features that are gated by
targetSdk are all enabled for ephemeral apps.

Test: adb install --ephemeral succeeds for CUR_DEVELOPMENT, fails for
N_MR1

Change-Id: I41b9ccc4995ba07d9a0c11b2918fa24c71892330

services/core/java/com/android/server/pm/PackageManagerService.java

@@ -15383,6 +15383,14 @@ public class PackageManagerService extends IPackageManager.Stub {
             Trace.traceEnd(TRACE_TAG_PACKAGE_MANAGER);
         }
 
+        // Ephemeral apps must have target SDK >= O.
+        // TODO: Update conditional and error message when O gets locked down
+        if (ephemeral && pkg.applicationInfo.targetSdkVersion <= Build.VERSION_CODES.N_MR1) {
+            res.setError(PackageManager.INSTALL_FAILED_EPHEMERAL_INVALID,
+                    "Ephemeral apps must have target SDK version of at least O");
+            return;
+        }
+
         // If we are installing a clustered package add results for the children
         if (pkg.childPackages != null) {
             synchronized (mPackages) {