Fix a deadlock in LockSettingsService

Order of taking locks in LSS: mSeparateChallengeLock -> mSpManager -> this.
Since getGateKeeperService().getSecureUserId() will end up calling
getSeparateProfileChallengeEnabled() which tries to acquire mSeparateChallengeLock
, we shouldn't be holding this lock while calling getSecureUserId()
Also spell out the order of taking locks in a comment.

Test: while device lockscreen is being changed, run "adb shell dumpsys lock_settings"
      and verify device is not locked up.
Bug: 37663848

Change-Id: I6b780ab5d1e33b07392f0ab0df29ecc3956f89ff