Make VDM APIs and permission annotations consistent

Some APIs are not annotated with RequiresPermission, though
they do require it. Some are missing the permission check, though
they should check for CREATE_VIRTUAL_DEVICE.

Also, move the createVirtualDisplay to the VirtualDevice object where
it belongs. This is leftover from the time where there was no device
object.

Bug: n/a
Test: presubmit
Flag: EXEMPT internal cleanup
Change-Id: Ieea53c2d513092c37a0ad98ac55a54dcc9129d5d