Allow MANAGE_TEST_NETWORKS to register limited agents

This puts in force some restrictions against test networks,
and in exchange relaxes the restrictions around registering
a network agent that provides a test network.
Test networks can only ever have transport TEST, and have
only a few capabilities available to them.

This is useful in particular to test CTS. See aosp/1253423
for first, basic usage of this capability.

Test: IpSecManagerTunnelTest
Test: new CTS aosp/1253423
Bug: 139268426

Change-Id: Ibd162792a7ab02fcbb06130f21a825a386678c05
(cherry picked from commit 2c129e97)