Implement retailDemo protection flag in the new subsystem.

Hopefully we can remove this later once we have the retail demo role.

Bug: 263504888
Test: Enroll in retail demo, reboot, then permission is granted.
Change-Id: I0aa75559114aa21f0def548258c10532ace0fb4a