DPM: Disallow some DeviceAdmin policies for ProfileOwners

A profile owner should only have control over the profile. All of the
following device admin APIs that affect the device beyond the profile
that they are called from are now disallowed:

 - Camera enable/disable
 - Keyguard
 - Wipe external storage

@bug 14434826

Change-Id: I69acfdf6f654f48b5db91aeb3ea86662d7857075