[enterprise-esim] Implement isSubscriptionEnterpriseManaged hidden API

Treat a subscription as enterprise-managed if it has the special
enterprise-management marker in access rules in addition to using the
group owner to infer the management state.

Test: atest FrameworksServicesTests:com.android.server.devicepolicy.DevicePolicyManagerTest
Flag: android.app.admin.flags.enterprise_esim_using_carrier_privileges
Bug: 373466339

Change-Id: I9091098887491829de2b11362a63570620a30c83