GRANT TRUSTED_OVERLAY after PiP is entered

- Make sure the TRUSTED_OVERLAY is only granted after WMShell
  successfully handled the entering PiP transition
- Revoke TRUSTED_OVERLAY in WM once the task is not pinned any more

Flag: EXEMPT securityfix
Bug: 436270922
Test: atest PinnedStackTests
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:b90e634cc2441ede9d30f0b7e52eb3e44c89efc0
Merged-In: Id849d93bc92209fc296ee91ef70b0ffe2a09550e
Change-Id: Id849d93bc92209fc296ee91ef70b0ffe2a09550e