VPN settings: gray out always-on checkbox dynamically

In the ConfigDialog for legacy VPNs, many configurations do not support
Always-on VPN. Previously, when a user entered an unsupported set of
settings, the Always-on VPN checkbox could still be ticked, and the
Save or Connect action buttons would be disabled. This was not intuitive
as the user could not easily figure out which part of the settings was
incompatible that grayed out the action buttons.

With this change, we disable the Always-on VPN checkbox immediately as
the user enters any incompatible setting. We also display the reason why
Always-on VPN is disabled. This will make it more straightforward for
the users to understand which setting is conflicting with the Always-on
feature.

This change is also the first step towards refactoring the ConfigDialog
for legacy VPNs with PreferenceFragment.

Test: manual
Bug: 29208008
Bug: 28072644
Change-Id: I1e6d32a1069ca0b936513f4985ffb9a9412b249c