Move 'is already always-on' check into Vpn.java

It's with the rest of the logic now and allows checking whether the
lockdown state matches, too, which led to a lot of misunderstandings.

Fix: 29199431
Change-Id: I94a2c38c4837f9c33b5b9c2becb52eeb7e2a2534