Fix broken RestrictedLockUtils KeyGuard APIs

They were all broken in that they returned profile admins for parent
queries even when they clearly shouldn't.

Examples:
 - disable unredacted notifications
 - disable fingerprint

This doesn't seem to have been tested beyond the bare basics of one
user with one device admin. Added some reasonable coverage. It could
still do with more.

Test: make RunSettingsLibRoboTests
Bug: 34929375
Change-Id: I1b0e986056ffa62d47091c0010977ac810ebd690