UsbDeviceManager: Implement trust USB restriction

The way it works now
* 0, do not restrict, do nothing / keep USB enabled.
* 2 (new), always restrict, keep USB disabled.
* 1 (default), restrict when locked.
  If unlocked, do not restrict.
  If locked but USB connected (presumably when unlocked),
  do not restrict to avoid ejecting that device, instead
  restricting USB once the device has been disconnected.

Co-Authored-By: jabashque <jabashque@gmail.com>
Co-Authored-By: Chirayu Desai <chirayu@calyxinstitute.org>
Change-Id: Ib997db7427960444a4c84a35d3c0db506840abdd