Add API for checking which CA certs were installed by the DO/PO

With this API, the system can determine whether a CA cert was
installed by the user or the user's DO/PO.

Bug: 32692748
Test: unit tests (see DevicePolicyManagerTest.java for invocation)
Test: cts-tradefed run cts-dev --module CtsDevicePolicyManagerTestCases

Change-Id: I3bcae5ac18ec2b110154184fc515df804fd73da6