Let admin disable fingerprint for the work challenge

Also, reworked the logic a bit:
* Admins can only set flags that affect the parent on the
  parent DPM instance (i.e. no unredacted notifications)
* Admins can set flags not supported on the work challenge on
  the regular DPM instance. If there is a work challenge,
  they will have no effect (as managed profile policies don't
  affect the regular lockscreen if there is a work challenge).
  If there is no work challenge, they'll affect the parent profile.

Bug: 26891832
Change-Id: I8978e1aa6abe9c8dc07e030dfd069b5f4e1301f6