SetupWizard: Turn off OEM unlocking during initial setup if bootloader is locked

* Some /e/ OS devices is meant to be used with a locked bootloader, and
  OEM unlocking set to off.
* Does what Settings -> Developer Options -> OEM unlocking off does but silently,
  wihout having to enable Developer Options.
* If you've locked the bootloader, and the device has booted into SetupWizard,
  it should be safe to run this since at that point you can most definitely
  get into Settings and run this yourself as well, and we do have the same
  kinds of checks here.
* Additionally grant missing permissions which was missing in CalyxOS.

Change-Id: I739d0808fc5c66656128f755451441de96764a90