Use API 28 signature retrieval APIs for the allowlisting logic

[SebastianJay]

UAMP uses PackageInfo#signatures, see

uamp/common/src/main/java/com/example/android/uamp/media/PackageValidator.kt

Line 107 in 2136c37

val isPackageInAllowList = certificateAllowList[callingPackage]?.signatures?.first {

- this is deprecated in API 28. The newer APIs involve using PackageInfo#signingInfo. The associated APIs on that class - apkContentsSigners, signingCertificateHistory, hasMultipleSigners - need careful attention to ensure they are used correctly. We could adjust UAMP to show proper usage of these APIs.

For reference, this StackOverflow answer - https://stackoverflow.com/a/53407183 - has a reasonable-looking implementation. My understanding is that in the apkContentsSigners path, we should check that all certificates matches, while in the signingCertificateHistory path, we need to only check that one certificate matches.