Merge "Allow system installer to deny update ownership" into udc-dev