Clone the VpnProfile in startLegacyVpnPrivileged()

The profile is modified within startLegacyVpnPrivileged(), e.g.
ipsecCaCert, ipsecUserCert. This causes subsequent calls from
callers such as LockdownVpnTracker to fail.

Make VpnProfile.clone() public and clone the VpnProfile before
modifiying it.

Bug: 190572822
Bug: 309591931
Test: New test in VpnTest
Test: Manual test always-on VPNs
Change-Id: I2a8dd03ef7da9b950df54ba993a527eb15272281