isSecureLockDeviceEnabled, isSecureLockDeviceAvailable APIs, persist across reboot

Adds new api AuthenticationPolicyManager#isSecureLockDeviceAvailable to
check if a device is eligible for Secure Lock Device: device must have a
strong biometric enrolled.

Adds isSecureLockDeviceEnabled API to check if the current
user is in secure lock device. This is determined by the value stored in
SecureSettings that is updated whenever secure lock device is enabled
or disabled.

The enableSecureLockDevice API is updated to check
isSecureLockDeviceAvailable and isSecureLockDeviceEnabled internally
before enabling secure lock device.

Defines SecureLockDeviceStore to store whether Secure Lock Device is enabled or
disabled, as well as the calling user that enabled secure lock device
when applicable. Updates Secure Lock Device to persist across reboot by
writing to XML in system data on changes.

Flag: android.security.secure_lock_device
Bug: 401645997
Fixes: 396640366
Fixes: 406266003
Fixes: 406532567
Bug: 396641431
Test: atest AuthenticationPolicyServiceTest
Test: atest SecureLockDeviceServiceTest
Test: atest CtsSecurityTestCases:android.security.cts.authenticationpolicy.AuthenticationPolicyManagerTest
Change-Id: I4cc57d1226619f253eb4ac22141a487029b5ab40