Permission Check For DPM.getUserProvisioningState

Require the caller of DPM.getUserProvisioningState() to hold the
MANAGE_USERS permission.  All callers should be apps involved in device
provisioning, which already hold this permission.

Bug: 62343414
Test: Run Device Owner sync auth provisioning manually
Test: Set up work profile with managed account manually
Test: com.android.server.devicepolicy.DevicePolicyManagerTest
Test:
com.android.managedprovisioning.finalization.UserProvisioningStateHelperTest
Test: com.google.android.setupwizard.tests.activity.QrScanControllerTest
Change-Id: Ib85433586d4dfb89019ca223fb925aca3d4bbf67