Rewrite trust USB restriction handling

* USB HAL 1.3's enableUsbDataSignal works so well
  that it instantenously ejects the usb device,
  which means we have to be smart about handling
  state 1, "restrict only when locked".

The way it works now
* 0, do not restrict, do nothing / keep USB enabled.
* 2 (new), always restrict, keep USB disabled.
* 1 (default), restrict when locked.
  If unlocked, do not restrict.
  If locked but USB connected (presumably when unlocked),
  do not restrict to avoid ejecting that device, instead
  restricting USB once the device has been disconnected.

Co-authored-by: Chirayu Desai <chirayudesai1@gmail.com>
Change-Id: Ib997db7427960444a4c84a35d3c0db506840abdd