Check user ID for domain verification setters

Validates the calling/target user IDs still exist, to handle race
conditions.

Since the data structures are not locked during the user check, also
adds a call during user creation to wipe the user data if there's any
stale values left. This should never practically happen, but it's a
fairly fast call just to make sure.

Bug: 182416431

Test: atest com.android.server.pm.test.verify.domain

Change-Id: I6cc270fb0e85f0c920b3b71a52e059e818066fac