Restrict adding managed profile in DO devices

On devices that have a Device Owner, or had a Device Owner and Profile
Owner and the managed profile was removed, apply the restriction
for adding a managed profile.

This would prevent such devices from getting into the DO+PO mode, which
is no longer supported in R.

Bug: 149006203
Test: Manual, set TestDPC as the Device Owner, upgrade it, observe TestDPC cannot create a managed profile.
Test: Manual, have a device with different DO and PO packages, remove PO, observe it cannot be re-added.
Change-Id: Iea48049a671071d2ad075b5e4c9ae3ce830975d3