Restrict launching activities on virtual displays

If an app creates a Surface and a virtual display backed by that
Surface, it can then launch activities and hijack their content.
This CL restrict activities that can be launched to virtual displays
created by apps only to those who set "allowEmbedded" attribute.
If a virtual display was created by system, apps won't get access to
the surface, so we're not limiting in this case.

Bug: 63094482
Test: android.server.cts.ActivityManagerDisplayTests
Test: #testLaunchNotEmbeddedOnVirtualDisplay
Change-Id: Ied216bdf33df4b5a6cc8cac0e006a4883a36f94f