Register APKCERTS_FILE on PACKAGES variable for prebuilt_apex

This is currently done for `soong_android_app_set.mk` but not for other
prebuilts (e.g. prebuilt_apex). In preparation for limiting apkcerts.txt
entries to the list of installed apps, register this variable.

Since a single apk can be in multiple prebuilt apexes, this CL also adds
a `sort -u` on the final output to prevent duplicates.

Bug: 399788149
Test: With RELEASE_APKCERTS_INSTALL_ONLY=true reapplied
(https://r.android.com/3552561), previously failed signing test now
passes
https://android-build.corp.google.com/builds/abtd/run/L03300030010481704

Test: presubmits
Change-Id: Ibe4f252317a8dbd25b735643f2c9142c75bd922b
diff --git a/core/Makefile b/core/Makefile
index 9db50a3..1f2a459 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -800,7 +800,7 @@
 	  $(if $(filter true,$(BUILDING_SYSTEM_EXT_IMAGE)),\
             $(call _apkcerts_write_line,BuildManifestSystemExt,$(FSVERITY_APK_KEY_PATH).x509.pem,$(FSVERITY_APK_KEY_PATH).pk8,,system_ext,$@)))
 	# In case value of PACKAGES is empty.
-	$(hide) touch $@
+	$(hide) touch $@ && sort -u -o $@ $@
 
 $(call declare-0p-target,$(APKCERTS_FILE))
 
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index d5261f4..5dfc6c1 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -39,6 +39,11 @@
 
 LOCAL_CHECKED_MODULE := $(my_prebuilt_src_file)
 
+ifneq (,$(LOCAL_APKCERTS_FILE))
+  PACKAGES := $(PACKAGES) $(LOCAL_MODULE)
+  PACKAGES.$(LOCAL_MODULE).APKCERTS_FILE := $(LOCAL_APKCERTS_FILE)
+endif
+
 ifneq (APPS,$(LOCAL_MODULE_CLASS))
 ifdef LOCAL_COMPRESSED_MODULE
 $(error $(LOCAL_MODULE) : LOCAL_COMPRESSED_MODULE can only be defined for module class APPS)