Store/Pass root digests of APEX payload

Root digests of APEX payload are now collected by microdroid_manager and
stored in instance.img and passed to apexd.

Bug: 199371341
Test: MicrodroidHostTestCases
Change-Id: I940347068400822f7d8140c3daf68036f553b087
diff --git a/microdroid/payload/metadata.proto b/microdroid/payload/metadata.proto
index 4c32dde..5ae2158 100644
--- a/microdroid/payload/metadata.proto
+++ b/microdroid/payload/metadata.proto
@@ -31,14 +31,13 @@
 
 message ApexPayload {
   // Required.
-  // The apex name.
   string name = 1;
-
   string partition_name = 2;
 
   // Optional.
-  // When specified, the public key used to sign the apex should match with it.
+  // When specified, apex payload should be verified with the public key and root digest.
   bytes public_key = 3;
+  bytes root_digest = 4;
 }
 
 message ApkPayload {