Replace checkSignatures() calls in AccountManager with a new,
rotation-aware call to PackageManagerInternal. Also add a new
AUTH cert capability to reflect the distinction between these
permissions and others.
Bug: 77651077
Test: Builds. CtsAccountManagerTestCases
Change-Id: Idd412cd984acf7d37555deb5879f2d6a0a10c2b6