Unconfigure the lockdown VPN if the user forgets its profile.

Currently, if the user clicks "forget" on the configuration
dialog for the profile that is currently being used by the
always-on VPN, we don't disable the lockdown VPN, and we crash
on next boot because ConnectivityService tries to start
LockdownVpnTracker with an invalid configuration.

Fix this by removing the LOCKDOWN_VPN variable in the keystore
(which disables the always-on VPN), and notifying
ConnectivityService.

Bug: 23625458
Change-Id: I3545286c9fc23517306aa94607a4b2cb55cc56c4