Disallow work profiles on non-initial users in headless

Modified 'canHaveProfile' method to ensure we allow work profiles only on initial user and not additional users- in both headless and non-headless environment.For that we can use isMain() as on non-headless, the system user(initial) is main,and on headless the first secondary user(initial) is main.

Test: atest
Bug: 266053489
Fix: 266053489

Change-Id: Ia959213b03ea7b36d113fd13e23fca187fe3f59d