Fix sensitive notification flag secure on resume

If a WindowState#isSecureLocked value changes while the window isn't visible (e.g. a sensitive notification is received), then the WindowState won't have a surface. Before flag secure was moved to WindowState from WindowStateAnimator, WindowStateAnimator#createSurfaceLocked would apply flag secure when the surface was created. Now that flag secure has moved to WindowState, we can apply flag secure to the layer immediately.

There's no public API to test this directly but CTS tests will be implemented in b/316954495 to provide coverage.

Bug: 315208576
Test: manually tested - app receiving sensitive notification in background gets flag_secure
Change-Id: I07a7212b00150061f9f07bf9bc599bb20231f194