Make BackupManager encryption aware.

Backup requires both CE and DE storage to be available, so delay
spinning up the backup system until the user is unlocked, since
that's when CE storage becomes available.  Note that devices without
FBE immediately transition USER_SYSTEM into the unlocked state,
since their CE is always available.

Offer to backup and restore files under both CE and DE.  Since DE
is effectively the same as CE, most logic is simply duplicated for
now, but it could be simplified in the future.  Since system apps
can force their default storage location to DE, we always build
explicit CE and DE paths.

Add getDataDir() to give clean access to the top-level private data
directory, but disclaim that apps shouldn't create files there.

Bug: 26279618
Change-Id: Ic34a4b330223725db93b1d0f5c9dffc88002c61f