Limit apkcerts.txt to installed apps if RELEASE_APKCERTS_INSTALL_ONLY

apkcerts.txt currently contains an entry for every app in the tree, even
if the app is not installed for the device. This CL limits the entries
to the list of installed apps if RELEASE_APKCERTS_INSTALL_ONLY is true

Bug: 399788149
Test: lunch panther-trunk_staging-userdebug
Test: m apkcerts-list
Test: manually inspected the apkcerts.txt file and verified the drop
Test: manually inspected the apkcerts.txt file and verified that
GoogleDialer (an android_app_import) exists in the file

Change-Id: I1bbf1ee38af6326a2ed90016404c99b8f90fcc94
diff --git a/core/Makefile b/core/Makefile
index 1a81b36..c5207c0 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -775,7 +775,13 @@
 intermediates := \
 	$(call intermediates-dir-for,PACKAGING,apkcerts)
 APKCERTS_FILE := $(intermediates)/$(name).txt
-all_apkcerts_files := $(sort $(foreach p,$(PACKAGES),$(PACKAGES.$(p).APKCERTS_FILE)))
+ifeq ($(RELEASE_APKCERTS_INSTALL_ONLY), true)
+  all_apkcerts_packages := $(filter $(call product-installed-modules,$(INTERNAL_PRODUCT)),$(PACKAGES))
+else
+  all_apkcerts_packages := $(PACKAGES)
+endif
+all_apkcerts_files := $(sort $(foreach p,$(all_apkcerts_packages),$(PACKAGES.$(p).APKCERTS_FILE)))
+
 $(APKCERTS_FILE): $(all_apkcerts_files)
 # We don't need to really build all the modules.
 # TODO: rebuild APKCERTS_FILE if any app change its cert.
@@ -783,7 +789,7 @@
 	@echo APK certs list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
-	$(foreach p,$(sort $(PACKAGES)),\
+	$(foreach p,$(sort $(all_apkcerts_packages)),\
 	  $(if $(PACKAGES.$(p).APKCERTS_FILE),\
 	    $(call _apkcerts_merge,$(PACKAGES.$(p).APKCERTS_FILE), $@),\
 	    $(if $(PACKAGES.$(p).EXTERNAL_KEY),\