Allow setting underlying networks when legacy lockdown enabled.

Currently, if a legacy lockdown VPN is up, no VPN can set
underlying networks. This does not make much sense.

When legacy lockdown VPN is enabled, no other VPN is allowed to
call prepare() or establish(), so no other VPN can connect, and
if no VPN can connect, then no VPN can set underlying networks.
Therefore, disabling the ability to set underlying networks only
affects the legacy lockdown VPN itself.

This change is necessary because in a future CL, the legacy
lockdown VPN will start to inform ConnectivityService of its
underlying network.

Bug: 173331190
Test: tests in subsequent CLs in stack
Change-Id: Ifa2aa3351c2c8324571f96fda151864ed987ed5a