Have UserManagerService clear the restrictions and unblock apps

Since this is an operation that could take a few seconds to run and needs to be
completed even if Settings dies, best to do it in the user manager.

Refactored PIN challenge/setup UI with a field to verify existing pin
when changing to a new one.

Change-Id: I0b7df5b2ccb7f343aa9282a9245d3bc2b577a794