RESTRICT AUTOMERGE Update CTS shim APKs

Because the CTS and pi-dev branches are no longer in sync, we can't
guarantee the version of the shim on the device. So, we now have to
inspect the device and use the correct version of the update APK
in order to upgrade it.

Built here:
https://android-build.googleplex.com/builds/branch-dashboard/ub-ctsshim-dev?build_id=5374186

./arm/CtsShimPrivUpgrade_v28.apk
package: name='com.android.cts.priv.ctsshim'
versionCode='28'
versionName='9-5374186'
compileSdkVersion='28'
compileSdkVersionCodename='9'
sdkVersion:'24'
targetSdkVersion:'28'

./arm/CtsShimPrivUpgradeWrongSHA_v28.apk
package: name='com.android.cts.priv.ctsshim'
versionCode='28'
versionName='WrongSHA'
compileSdkVersion='28'
compileSdkVersionCodename='9'
sdkVersion:'24'
targetSdkVersion:'28'

./x86/CtsShimPrivUpgrade_v28.apk
package: name='com.android.cts.priv.ctsshim'
versionCode='28'
versionName='9-5374186'
compileSdkVersion='28'
compileSdkVersionCodename='9'
sdkVersion:'24'
targetSdkVersion:'28'

./x86/CtsShimPrivUpgradeWrongSHA_v28.apk
package: name='com.android.cts.priv.ctsshim'
versionCode='28'
versionName='WrongSHA'
compileSdkVersion='28'
compileSdkVersionCodename='9'
sdkVersion:'24'
targetSdkVersion:'28'

Bug: 121306802
Test: Flash pi-release on sailfish
Test: cts-tradefed run commandAndExit cts-dev --module CtsAppSecurityHostTestCases --test android.appsecurity.cts.PrivilegedUpdateTests
Test: Flash AOSP pie-dev [with aosp/929880 applied] on sailfish
Test: cts-tradefed run commandAndExit cts-dev --module CtsAppSecurityHostTestCases --test android.appsecurity.cts.PrivilegedUpdateTests
Change-Id: Ifda7c004bd2a4b70ee15608f9a716b37535b9ea4