AF: Fix bug where Session#setViewStatesLocked doesn't clear response.

clearResponse=true doesn't clear the response if the `response` arg is non null.
The new behavior matches the corresponding logic for authenticated
responses above (lines 3197-3200).

This affects only 1 invoking method, replaceResponseLocked, which sets
the responses again soon after, so this change shouldn't affect any
behavior.

This change also fixes the javadoc for the method.

Bug: 152620157
Test: atest android.autofillservice.cts
Test: manual
Change-Id: I78262baa1c6c11ef7e4b3c12c2ecd3d9dd28bfd7