Convert Vpn from NetworkStateTracker to NetworkAgent.

This eliminates the need for the ConnectivityService.VpnCallback class.
This requires shifting VPNs to the new "network" netd API.
VpnService.protect() is modified to no longer go through ConnectivityService.
NetworkCapabilities is extended to add a transport type for VPNs and a
capability requiring a non-VPN (so the default NetworkRequest isn't satisfied
by a VPN).

bug:15409918
Change-Id: Ic4498f1961582208add6f375ad16ce376ee9eb95