Fix LSS unit tests and make behaviour consistent under synthetic password

1. Fix LSS unit tests: new credential initialization steps when synthetic
   password is used.
2. Fix LSS behaviour under SP: If credential matches but type doesn't, treat
   this as failure.
3. Fix LSS behaviour under SP: when changing credential, if old credential is
   provided but is incorrect, fail instead of performing an untrusted enroll.

Bug: 63064202
Test: runtest frameworks-services -p com.android.server.locksettings
Change-Id: I762d3f4cc8fa5e4270b851721e0208c7a0f0152a