Finish authentication client when rejected

For passive modalities, the HAL enters the idle state after getting
a reject. This is in contrast to fingerprint, which currently stays
in the authenticating state until either onAuthenticated(true) lockout.

Fixes: 124340515

Test: manual
Change-Id: Ifd4f1d34c77c847e3844185c748f59e8e3ed6106