Be more defensive on failure to disconnect legacy VPNs

Failing to disconnect but deleting the keystore entry anyway makes
it difficult to do anything about a still-running connection.

Also switching over from prepareVpn(x,x) to prepareVpn(null,x) which
helps avoid race conditions where in between the getLegacyVpnInfo and
prepareVpn calls a 3rd-party app started a connection, which would break
the disconnect but still register as success.

Bug: 23529835
Bug: 29032008
Change-Id: Iedce784cb0eafbf75fe015dd2b3d355fcd887abf