Point "unlocked" logic at lower level.

There is a race when starting a non-encryption-aware launcher before
we've gone through the user lifecycle to enter the "running unlocked"
state.  This can cause the launcher to choke when it's denied access
to widgets that are still considered locked.

For now, relax the notion of a user being unlocked to reflect the
on-disk state, instead of looking at the user lifecycle.

Also add logging of encryption commands.

Bug: 26267450
Change-Id: Ie330d07418cf10413e0b4380f6d6781684f01952