Fix access control isAlwaysOnVpnLockdownEnabled

* Let the caller who has PERMISSION_MAINLINE_NETWORK_STACK
  bypass the admin authentication check.
* Use getCallerIdentity variant that allows caller to not
  be an admin.
* If the caller is a device owner or profile owner, then
  the admin must be authenticated

Bug: 171407399
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
      atest com.android.cts.devicepolicy.MixedDeviceOwnerTest
Change-Id: Id7152425fd774fc79d511c2e95dbb78ca1e0fc01