Do not show work challenge when profile is turned off.

When the profile is turned off, the associated user is not running so it
makes no sense to try to unlock the profile challenge.

Also adjust order of activity startup interception so suspend package takes
precedence, as that's a state user cannot recover from by his own actions.

Bug: 26928131
Change-Id: Ibb4c8ce02ba4ed2e5a5b4366cbe7b59d1535dbd7