Add OEM config for enhanced confirmation mode and add restricted read ops

OEM can set the config in config.xml to enable / disable enhanced
confirmation mode.
And now we only allow apps with manage appops permission to read
ACCESS_RESTRICTED_SETTINGS op, so bad apps cannot know if the app is
in restricted setting mode

Bug: 217711280
Bug: 217709978
Test: atest AppOpsTest#testRestrictedSettingsOpsRead
Test: With OEM config on, accessibility page for unknown source app is
disabled by default.
Test: With OEM config off, accessibility page for unknown source app is
not disabled.
Change-Id: I6da408306ae43972b7af81c0a3c91bf95e9d6993

Change-Id: I9b79c2edb1341246e75c0d495e3158d370cd7d22