Ask profile password before disabling quiet mode

With "Turn off work 2.0" when the profile is put into quiet mode
the user is not stopped and its storage is not locked. Because of
that it is not sufficient to check for storage state - if the
profile has separate challenge, always ask for it.

Also, mark such user as locked in TrustManager.

Bug: 258823777
Test: manual
Change-Id: Ie5d79c3b149b63cf198ee61d550f1c93356d8977