Vpn settings per vpn

This CL adds a setting for each VPN
- When no_config_vpn user restriction is applied, user can't change anything in the page
- Launch the subsetting activity in the corresponding user to unlock keystore and force work challenge
- Show dialog when user replace always-on-VPN package
- When forget VPN, unset always-on-vpn

TODO: show per-VPN status in VPN list

Change-Id: Ica360ea44117db6a4ecfaed1eec6c188189c246c