Add support for custom certificate packages

[codysoyland]

• Extend installCertificates to collect certificate files from installed APK packages that declare Provides: custom-ca-certificates, in addition to inline certificates from the image config
• Certificates from qualifying packages are read from the filesystem, parsed, and appended to the CA bundle (ca-certificates.crt) and Java truststores, replacing what update-ca-certificates post-install scripts would normally do
• When no existing CA bundle is present, the primary bundle is now created automatically if certificates need to be installed