Force LSKF in ConfirmCredential UI when pending escrow token exists

Escrow tokens can only be activated by user confirming their LSKF,
while ConfirmCredential allows both LSKF and biometrics by default.
By requiring LSKF, it simplifies the DPC's flow of requesting the user
to activate a pending escrow token.

This change introduces an internal API to query the existence of
pending escrow tokens.

Bug: 127377026
Bug: 76084679
Bug: 79547502
Test: atest frameworks/base/services/tests/servicestests/src/com/android/server/locksettings/
Change-Id: Ie1ae58d2639394a9e6e1bf13d8bde44dfea240e8