BufferQueue: plumbing mConsumerIsProtected

This replaces current logic in BufferQueue that uses
GRALLOC_USAGE_PROTECTED to indicate whether an ANativeWindow is capable
of handling hardware protected gralloc buffers. Current logic is
problematic as it enforces producer to use protected buffer no matter
whether producer side is capable of writing into a protected buffer.

This new solution, however, introduces a new NATIVE_WINDOW_* flag that
consumer can set on IGraphicBufferConsumer to indicate its capacity,
which can then be queried by producer via Surface::query (or
IGraphicBufferProducer::query).

When consumer is capable of reading protected buffer (e.g. a protected
GL context), the producer can generate either a protected or unprotected
buffer.

When consumer is not capable of reading protected buffer, the producer
should only generate unprotected buffer.

Bug: 35726763
Test: videoplayer-nodrm-protected.apk and videoplayer-drm-protected.apk
both works.

Change-Id: I1bf6814c9f1f81f9e04f0e89646b0733ff1a4758