[AAPM] Clean up Multi User scenarios

1. Store AAPM state as system user rather than main user. This is to
account for main user behavior potentially changing in the future.
2. Ensure only admin users can change Advanced Protection State

Bug: 398825840
Test: atest AdvancedProtectionManagerTest AdvancedProtectionServiceTest
Test: manually testing on device
Test: adb shell cmd advanced_protection set-protection-enabled true
Test: on main and secondary users
Flag: android.security.aapm_api
Change-Id: If806626f19954433265520ee8552f6206707587f