Merge "Treat allowlists differently for flattened apex" into tm-dev