VDM limitations for untrusted displays

 - no input support
 - no wakelock
 - put them in the default display group
 - no pointer icon access
 - no custom IME
 - always show apps running on these displays in recents
 - enforce ADD_ALWAYS_UNLOCKED_DISPLAY permission to set the
   virtual device lock state to LOCK_STATE_ALWAYS_UNLOCKED
 - enforce ADD_TRUSTED_DISPLAY permission to set the
   virtual device clipboard policy to CUSTOM
 - ensure that all displays for a device with a CUSTOM
   clipboard policy are trusted

Fix: 370653882
Fix: 370656714
Fix: 370653884
Fix: 371132007
Fix: 370653363
Fix: 370657091
Fix: 370653365
Test: presubmit
Flag: EXEMPT bugfix
Change-Id: If794df68aa261e9656c92e3cfc4aaf02b82a3ea7