GRANT TRUSTED_OVERLAY after PiP is entered

- Make sure the TRUSTED_OVERLAY is only granted after WMShell
  successfully handled the entering PiP transition
- Revoke TRUSTED_OVERLAY in WM once the task is not pinned any more

Flag: EXEMPT securityfix
Bug: 436270922
Test: atest PinnedStackTests
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:8a84266ada6944eff7e5c73bdee3caefda364bf3
Merged-In: Id849d93bc92209fc296ee91ef70b0ffe2a09550e
Change-Id: Id849d93bc92209fc296ee91ef70b0ffe2a09550e