Add a DISALLOW_ADD_PRIVATE_PROFILE user restriction

Enforce this restriction while creating a private profile on devices
with device owner set.

Bug: 295865540
Test: atest FrameworksServicesTests:com.android.server.devicepolicy.DevicePolicyManagerTest
Test: atest FrameworksServicesTests:com.android.server.pm.UserManagerTest
Test: Manual - Verify private user creation is allowed before setting
the device admin, not allowed after setting the device admin, and
allowed again after removing the device admin.

Change-Id: Ie63f3eb71898917beb5b893a0b94e024b784e564