Restrict VPN Diagnostics callbacks to underlying networks.

ConnectivityDiagnosticsCallbacks should only be invoked for the
underlying networks declared by active VPNs. This encourages VPN apps to
declare their underlying networks.

The previous permission model for VPNs allowed active VPNs to receive
callbacks on any network.

Bug: 148903617
Test: atest FrameworksNetTests
Change-Id: Ic08cdd2e2532580fda0fd3034e2bdff27e0ff84b
Merged-In: Ic08cdd2e2532580fda0fd3034e2bdff27e0ff84b
(cherry picked from commit e1f0c56f)