Block address families by default in VpnService.

If a VpnService only configures IPv4 addresses, routes and DNS servers, block
IPv6 by default, and vice versa. Also add an API to unblock a family without
needing to add an address, route or DNS server.

New API with stub implementation to be filled out later.

Bug: 15972465
Change-Id: I70d4d5c30ee71802610f6e16f100db6cbccef42c