Minor refactoring in DPMS.

* extracted enforceSystemCaller

* only allow system callers to call reportPasswordChanged. Currently
  access is limited to callers posessing BIND_DEVICE_ADMIN and having
  cross-user permission when calling for different user. Since this is
  a hidden API and is only called from LockSettingsService, narrow
  callers down to system only.

Bug: none
Test: atest --generate-new-metrics 10 com.android.cts.devicepolicy.ManagedProfileTest#testResetPasswordWithTokenBeforeUnlock com.android.cts.devicepolicy.ManagedProfileTest#testClearPasswordWithTokenBeforeUnlock
Change-Id: Iab4ff1e4827a6217eedc5fade5641845ad72e8f0