Protect entry points to add an eSIM when admin restricted

If the DISALLOW_CONFIG_MOBILE_NETWORKS admin policy is set, we were
accidentally still allowing access to the flow where you add an eSIM
subscription via the "plus" button on the Network & internet page. While
fixing this, I also noticed that the mobile networks list page (which
only becomes available if you have multiple subscriptions) has a link at
the bottom to start the flow as well, and that wasn't being protected.

The fix for the plus button on the Network & internet page was just to
make sure not to call setEnabled(true) if the preference was already
disabled by admin policy, since that has the effect of overriding the
admin-disabling.

The fix for the mobile networks list page just needed to add the
relevant tags in the layout XML, and then we get it for free.

Fixes: 137627845
Test: make RunSettingsRoboTests
Change-Id: I896ac248f50aaeecc157791938a0a0a98265aa07