Require unlocked work profile to change notification settings

Require that the work profile be started and unlocked before the user
can change the notification settings for the work profile.

That prevents leaking of notifications from the work profile, which
could happen when the user set the work profile notifications to show
even if the profile was unlocked (an example scenario is a family member
of the user using the device while the work profile is locked).

Test: Manually with TestDPC
Bug: 75252682
Change-Id: I300d001b7439c0a1d0130d7dbc9ec4c2430be227