Only include exported flags in android-flags.jar

The android-flags.jar file is consumed by apps built outside the
platform. These apps should only have access to exported flags (as
defined by the flag_declaration `is_exported` field).

Teach soong to filter out non-exported flags when generating
android-flags.jar.

Bug: 311151343
Test: m sdk dist # manually verify that $(gettop)/out/dist/android-flags.jar only contains exported flags
Change-Id: If66321fcffd920040dae3d99bd7ef69ff6925b18

aconfig/init.go

@@ -71,9 +71,17 @@ var (
 	// java_aconfig_libraries to be consumed by apps built outside the
 	// platform
 	exportedJavaRule = pctx.AndroidStaticRule("exported_java_aconfig_library",
+		// For each aconfig cache file, if the cache contains any
+		// exported flags, generate Java flag lookup code for the
+		// exported flags (only). Finally collect all generated code
+		// into the ${out} JAR file.
 		blueprint.RuleParams{
 			Command: `rm -rf ${out}.tmp` +
-				`&& for cache in ${cache_files}; do ${aconfig} create-java-lib --cache $$cache --out ${out}.tmp; done` +
+				`&& for cache in ${cache_files}; do ` +
+				`  if [[ -n "$$(${aconfig} dump --cache $$cache --filter=is_exported:true --format='{fully_qualified_name}')" ]]; then ` +
+				`    ${aconfig} create-java-lib --cache $$cache --mode=exported --out ${out}.tmp; ` +
+				`  fi ` +
+				`done` +
 				`&& $soong_zip -write_if_changed -jar -o ${out} -C ${out}.tmp -D ${out}.tmp` +
 				`&& rm -rf ${out}.tmp`,
 			CommandDeps: []string{