Add ActiveUnlock check when picking preference

Modify BiometricsSettingBase to also track if the hardware is supported
and if the controller is a work profile controller. If the hardware is
supported and active unlock is enabled, non-work profile controllers
will still be displayed.

Test: make RunSettingsRoboTests
Test: manually flip flags on device with active unlock, confirm new
layout used
Bug: 264813302

Change-Id: Idb0e994453d4fd5c078c45f87d5d8cee339053a2