If the proider model is enabled, the User cannot create insecure VPNs

Additionally, existing secure vpns cannot have their type changed to an
insecure type.
Existing insecure VPNs can be edited, but once the type is changed to a
secure type, it cannot be set to an insecure type again.

Note that devices without FEATURE_IPSEC_TUNNELS still have the ability
to make insecure VPNs at the moment. What to do about these devices will
be addressed in a future change.

Recall video with this Change: https://recall.googleplex.com/projects/a801b0cf-91a5-414e-973b-3c1c8fb5e7be/sessions/bc54e4f2-0205-4822-a51a-382e54f3a956

Test: atest -c SettingsUnitTests
Bug: 176821216
Change-Id: Icf87419650c934a783b01f4d2907b7f704d139b8