6/n: Decouple remainder of lockout stuff

Split/rename LockoutTracker into interface + implementation. This
allows us to have different implementations (framework implementation,
HAL implementation) that can be passed to AuthenticationClient. This
lets us 1) Compartmentalize lockout tracking, and 2) Decouple the
AuthenticationClient from relying on FingerprintService/FaceService's
member variables.

This change also removes the need for AuthenticationCliemtImpl. A
following change will decouple FingerprintAuthClient and
FaceAuthClient from FingerprintService/FaceService entirely.

Bug: 157790417
Test: Lockout on primary/secondary users

Change-Id: I25ff870d8e05f36c01601ab5f313477bcd42c137