Do not require reauth when turning on profile with unified challenge

Encrypt a copy of the profile unified challenge with an auth-bound key
of 7-day timeout, so that the framework can rederive the challenge as
long as the user has unlocked the device in the last 7 days.

Bug: 72178550
Test: atest com.android.server.locksettings
Test: atest com.android.cts.devicepolicy.QuietModeHostsideTest

Change-Id: Icb1335ebce2bd1a29f5a7111b61536578fccedd5