Move UserManagerInternal into services.jar

Because SettingsProvider needs to call through the IUserManager
interface there is now a method to provide restricted-access information
via that route.  It has the same protection as the implicit local
service call surface that was previously used:  only system-uid callers
can invoke it.

Bug: 140833849
Test: system boots & runs normally
Change-Id: I05823ca57240ab10feb382c45590541212e406c1