Add DISALLOW_CREATE_WINDOWS to Device Owner only user restrictions

Even though the documentation of DISALLOW_CREATE_WINDOWS says it is for
Device Owners and Profile Owners on User 0 only, it was previously not
part of DEVICE_OWNER_USER_RESTRICTIONS and was therefore callable from
a profile owner on a managed profile or secondary user.

Bug: 19726884
Change-Id: If6443eacbc28b7ee6c0845754923573a79f8bde3