GRANT TRUSTED_OVERLAY after PiP is entered

- Make sure the TRUSTED_OVERLAY is only granted after WMShell
  successfully handled the entering PiP transition
- Revoke TRUSTED_OVERLAY in WM once the task is not pinned any more

Flag: EXEMPT securityfix
Bug: 436270922
Test: atest PinnedStackTests
Merged-In: Id849d93bc92209fc296ee91ef70b0ffe2a09550e
Change-Id: Id849d93bc92209fc296ee91ef70b0ffe2a09550e