Make fix_unlocked_device_required_keys a build-time flag

This flag will need to be accessed from keystore2, which is started
before the DeviceConfig-based flag infrastructure is available.  Also,
LockSettingsService in system_server will need to vary its start-up
behavior depending on this flag, so toggling this flag at runtime won't
work properly anyway (unless the device is immediately rebooted).

Bug: 296464083
Test: build
Change-Id: I22327798e0fe804144bbedb3e57f57b60b85e72a