Make extra APKs easier to specify

Allow extra APKs to be specified in VirtualMachineAppConfig as an
alternative to the config file, so the paths don't need to be fixed.

This involves adding:
- the extra_apk_count to the metadata proto, which is persisted in the
  instance image.
- the extra APK fds to VirtualMachinePayloadConfig, so it can be
  included in VirtualMachineAppConfig iff there is no config file.

And then a whole lot of plumbing to make it all work.

Using this requires the USE_CUSTOM_VIRTUAL_MACHINE permission, and is
behind the multi-tenant feature flag.

I've not attempted to add API yet (this CL is already big), but I have
extended the vm command to allow it to be exercised.

Bug: 303201498
Test: Start a VM with an extra APK specified on the `vm run-app`
  command line.
Change-Id: Ib5da40a33960fd9639b62e8d77e865aeb1f6398b
diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index bf95cff..86284a5 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -43,7 +43,7 @@
 use libc::VMADDR_CID_HOST;
 use log::{error, info};
 use microdroid_metadata::PayloadMetadata;
-use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
+use microdroid_payload_config::{ApkConfig, OsConfig, Task, TaskType, VmPayloadConfig};
 use nix::sys::signal::Signal;
 use openssl::hkdf::hkdf;
 use openssl::md::Md;
@@ -580,11 +580,15 @@
                 type_: TaskType::MicrodroidLauncher,
                 command: payload_config.payload_binary_name,
             };
+            // We don't care about the paths, only the number of extra APKs really matters.
+            let extra_apks = (0..payload_config.extra_apk_count)
+                .map(|i| ApkConfig { path: format!("extra-apk-{i}") })
+                .collect();
             Ok(VmPayloadConfig {
                 os: OsConfig { name: "microdroid".to_owned() },
                 task: Some(task),
                 apexes: vec![],
-                extra_apks: vec![],
+                extra_apks,
                 prefer_staged: false,
                 export_tombstones: None,
                 enable_authfs: false,