Allowing FaceUnlock with a PIN fixes 5467194

We need to allow FaceUnlock if the backup lock supports encryption (PIN).
This requires changing the way the minimum encryption quality is enforced
to allow FaceUnlock as long as the backup lock is a PIN, as FaceUnlock
is considered a lower security than the minimum for encrypted drives.
This change adds some complexity to upgradeQualityForEncryption because it's
used in two places: once to grey out selections that aren't sufficient
security level, and second to force the user to use a higher security level.
This still increases the minimum security level,
but makes an exception for FaceUnlock if it's allowed without encryption.

This uses a MutableBoolean to provide a mutable boolean capability.
We could instead write a custom one or use some other type of mutable
boolean if it exists.

In CryptKeeperSettings, using getKeyguardStoredPasswordQuality directly instead
of getActivePasswordQuality is simpler, but this uses a more complex approach
with a minor tweak as jaggies suggested it and it is clear about the
biometric exception being made.

Change-Id: Ia2645d6bd98857c79c6a9be45eda98087bfe517a