Allow disabling keyguard widgets for work profile

Add the flag `KEYGUARD_DISABLE_WIDGETS_ALL` to the flag mask to allow
it to be always set on the profile, as well as on the parent profile
of a COPE device.
This will provide flexibility for DPM to control keyguard widgets on
work profile separately.

Bug: b/332590662
Test: toggle the setting in TestDPC and run command to verify
`adb shell dumpsys device_policy | grep disabledKeyguardFeatures`
Flag: N/A

Change-Id: I198371b6a5139393cc98b41148831b3b813c031d