Use image oat file instead of image header for immune spaces

The old immune spaces logic used the oat file information in the
image header instead of the actual oat file pointer. This was
incorrect for the app image case since the app image oat file is
not necessarily at the address specified in the header. This bug
could cause an incorrect immune region that caused large objects
to get freed if they were within this immune region.

Added test.

Bug: 22858531
Change-Id: I243253e61ea1afd42c3bb2414c02ce6dd36d0f9c
diff --git a/runtime/image.h b/runtime/image.h
index c449e43..146ee00 100644
--- a/runtime/image.h
+++ b/runtime/image.h
@@ -143,6 +143,8 @@
     oat_checksum_ = oat_checksum;
   }
 
+  // The location that the oat file was expected to be when the image was created. The actual
+  // oat file may be at a different location for application images.
   uint8_t* GetOatFileBegin() const {
     return reinterpret_cast<uint8_t*>(oat_file_begin_);
   }