Allow profile owners to protect packages.

Changed how protected packages are stored in package manager:
* previously they were stored in a map from DO package into
  a list of protected packages. This isn't expressive enough
  to allow POs: the same PO package on different users may
  protect different packages.
* now they are stored in a map from userId into a list of
  protected packages. In case when the DO sets the policy
  the userId will be UserHandle.USER_ALL, otherwise it will
  be the calling user.

Bug: 218639412
Test: atest UserControlDisabledPackagesTest
Change-Id: I2d1d33acad035610c8db365f69b7a15faa03a2d5
Merged-In: I2d1d33acad035610c8db365f69b7a15faa03a2d5