[SecurityController] Listen to USER_UNLOCKED

So far, SecurityControllerImpl waits for user switches to update
its certificate cache. Most of the time the certificates are not
ready yet, since it is too early in the boot process.

With this CL, we only check certificates after receiving the
ACTION_USER_UNLOCKED broadcast. This allows us to remove the
retry-mechanism that patched over the above problem.

Bug: 141698830
Test: atest SecurityControllerTest
Change-Id: I2c6cacc6d4ab65c3b4c44f7cc88deaf57cc40789