Device Policy API to choose a private key silently

Support for certificate chooser (keychain) to first query a profile
owner (if one exists) for a silent credentials grant which will be
passed back to the caller as an alias.

Bug: 15065444
Change-Id: I0729b435c218b7991e6cb5faedefb7900577afcc