Add build fingerprint checks to APK sessions

In order to prevent a staged install taking place after
receiving an OTA, set the status of a staged session to
failed if PackageManagerService.isDeviceUpgrading is
true.

Bug: 145840157
Test: atest StagedInstallTest#testInstallApkChangingFingerprint
Change-Id: I7834bed49b2c7af80f2f07a937f9e15860c13910
Merged-In: I7834bed49b2c7af80f2f07a937f9e15860c13910
(cherry picked from commit de8174b355)

services/core/java/com/android/server/pm/PackageInstallerService.java

@@ -259,6 +259,10 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
         // Don't hold mSessions lock when calling restoreSession, since it might trigger an APK
         // atomic install which needs to query sessions, which requires lock on mSessions.
         for (PackageInstallerSession session : stagedSessionsToRestore) {
+            if (mPm.isDeviceUpgrading()) {
+                session.setStagedSessionFailed(SessionInfo.STAGED_SESSION_ACTIVATION_FAILED,
+                        "Build fingerprint has changed");
+            }
             mStagingManager.restoreSession(session);
         }
         // Broadcasts are not sent while we restore sessions on boot, since no processes would be