disable 2g networking when advanced protection is enabled

This needs to happen both when the service starts (after reboot) as well
as when the state changes.

If the APM is disabled (after having been enabled) the switch needs to
fall back to the more-secure mode (2G disallowed) but allow the user to
re-enable it if desired.

Test: manually check switch is greyed out and disabled when aapm is
enabled
Test: manually check switch is available, but off, when aapm is disabled
Bug: 374803296
Flag: android.security.aapm_feature_disable_cellular_2g

Change-Id: Iec108733cf8353ad90329d9999fb4e08916522c3