Create work challenge timeout

The work challenge should be locked whenever the device goes to sleep + admin
timeout or when the power button is pressed if the lock setting is on.

This change creates the infrastructure to lock a specific user instead of the
device and uses it in these cases. Then, the current code that brings up the
work challenge can check to only show it if the user is locked.

Change-Id: I89b4342b1458d97734d7afa66be52bf04ec3a3d4