Move CompOS to /system_ext

We shouldn't be on /system since we're not generic (yet).

But we are closely coupled to /system (integrated with ART, will be
contributing to the system server classpath.

Prune the artifact path files to only the ones that are still written
to /system while we figure out what to do with them.

While I'm here, fix writing various Rust dylib.so files to /system by
making sure the "vm" binary prefers the rlibs.

Test: Boots, APEXes present
Bug: 186126194
Change-Id: Id84fb7bf0fb4e0fb56e0cb896394c31e5c7b5124
diff --git a/apex/Android.bp b/apex/Android.bp
index 4775f0c..9d6cc94 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -17,6 +17,8 @@
     updatable: false,
     platform_apis: true,
 
+    system_ext_specific: true,
+
     manifest: "manifest.json",
 
     key: "com.android.virt.key",
diff --git a/apex/product_packages.mk b/apex/product_packages.mk
index fef6316..e78d3dc 100644
--- a/apex/product_packages.mk
+++ b/apex/product_packages.mk
@@ -21,17 +21,8 @@
 
 PRODUCT_PACKAGES += \
     com.android.compos \
-    com.android.virt
+    com.android.virt \
 
+# TODO(b/207336449): Figure out how to get these off /system
 PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \
-    system/apex/com.android.compos.apex \
-    system/apex/com.android.virt.apex \
-    system/bin/crosvm \
-    system/lib64/%.dylib.so \
-    system/lib64/libfdt.so \
-    system/lib64/libgfxstream_backend.so \
-    system/lib64/libcuttlefish_allocd_utils.so \
-    system/lib64/libcuttlefish_fs.so \
-    system/lib64/libcuttlefish_utils.so
-
-$(call inherit-product, external/crosvm/seccomp/crosvm_seccomp_policy_product_packages.mk)
+     system/lib64/libgfxstream_backend.so \