Reject encryption drop in Common Criteria mode

For NCIS certification, we need to drop the connection or
reestablish encryption after receiving a command to disable link
layer encryption on an encrypted link.  However, dropping the
connection for all devices breaks compatibility during role switch
with devices running Bluetooth 2.1 or earlier, a category including
many cars still in the field.

Add a check forcing connections to drop in this case, conditioned on
Common Criteria mode..

Bug: 251436534
Test: atest: bluetooth, lab validation forthcoming
Tag: #security
Ignore-AOSP-First: Security
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1ee290b87b23c30d4389c2de283e01f72b2db17a)
Merged-In: I94654ebeb16774643107ee41473725cfae3764ab
Change-Id: I94654ebeb16774643107ee41473725cfae3764ab