GRANT TRUSTED_OVERLAY after PiP is entered

- Make sure the TRUSTED_OVERLAY is only granted after WMShell
  successfully handled the entering PiP transition
- Revoke TRUSTED_OVERLAY in WM once the task is not pinned any more

Flag: EXEMPT securityfix
Bug: 436270922
Test: atest PinnedStackTests
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:492b6ca4f31e79d9fced383a59957234aef8f8dc
Merged-In: Id849d93bc92209fc296ee91ef70b0ffe2a09550e
Change-Id: Id849d93bc92209fc296ee91ef70b0ffe2a09550e