Make the sensor privacy state per user

For the spaceship mode this is purely an internal refactorization since
all the apis remain the same and the state is kept in sync across users.
For the individual controls there's new calls to set the state of the
toggle per user or per profile group.

Test: Manually change state with `adb shell cmd sensor_privacy enable 0
          microphone`
      Manually upgrade from old persistence to new persistence form
      Manually check that the persisted state remains when rebooted.
Bug: 162549680

Change-Id: I0a5eac7a5c3beb272a456790d999a0282d77bf09