Disallow fingerprint based on user unlock state.

Previously, the KeyStore lock state was used but this doesn't hold any
real value and may be removed in future. The user unlock state is the
source of truth we are looking for.

Test: Enroll finger, turn off work, lock and unlock device, turn on
work, asked for pin but can no longer user fingerprint.
Fixes: 34858001

Change-Id: I228952f4f7fd24916d294b5b523c6d3609520506