Disallow DA to reset password, also fix all DO checks

Now pure DA (not PO, not DO) aren't allowed to change the password
if one is already set.

Also update "isDeviceOwner" check and make sure we always take
user-id into account.  If one really wishes to check the package name
only, then use getgetDeviceOwner() instead.

Also change the enforceNotManagedProfile() check to what's more
generic in the FBE world.

Bug 25645900
Bug 25547523
Bug 25643916

Change-Id: I588ecf9452fe3acc1fb0b4ca0457ad662382fcd2