Don't accept score below 0.

Network Factories are allowed to go below, but networks need to be
constrained.  Allowing the network to go below 0 meant that -1 could
sometimes leak through and foul the logic.

The core of 17361330 will be fixed when we stop sending scores for
listens to NetworkFactories, but it exposed this issue too.  Summary:

1 - add a network listener.  This isn't  a request so it's not sent
to networks.
2 - alter your score (ethernet sets score to -1 when the link goes
down) (16:07:39.782)
3 - a bug in ConnectivityService causes score changes to get sent for
all network requests and network listeners causing NetworkFactories
to no see 2 entities.  This bug will be fixed by a pending change
(https://googleplex-android-review.googlesource.com/#/c/540840/).
This causes the ethernet NetworkFactory to see two entities, both
served by networks of score -1.  (16:07:39.989)
4 - disconnect Ethernet - this only sends 0 scores for known
requests, not network listeners.  Had it been sent for both entities
they both would have evaluated that the networkfactory score (-1)
was lower than the request score (0) and both released their
refcount. (16:08:03.147)
5 - this means the listener is tracked by the EthernetNetworkFactory
with a score of -1 while the factory itself has a score of -1 so the
network release isn't called.

bug:17361330
Change-Id: Ife34ca0f9c233dd3c3df80f6fea580af43afcdeb