Disallow entering PiP without dismissing keyguard.

- If an activity is showing on the keyguard and enters picture-
  in-picture, then prompt the user to authenticate first
- Fixing NPE in SystemUI due to null runnable being added to the
  post-keyguard-gone callbacks
- Prevent FLAG_SHOW_WHEN_LOCKED from applying when determining
  visibility over keyguard for activities that are in the pinned
  stack

Bug: 33660880
Test: android.server.cts.KeyguardLockedTests
Test: #testEnterPipOverKeyguard

Change-Id: I89477a8a0067e285e5d0122e918fac45274c57ad