Always send userId to FaceService

resetLockout may take longer on some devices, causing FaceSettings
setActiveUser to be overwritten. To be safe, invoke updateActiveGroup
whenever user-specific functionality is invoked from the upper layers.

Ideally setActiveUser + operation should be atomic. In the future perhaps
we could consider changing HIDL so each method is user-aware, but for now
this is the only thing we can do.

Fixes: 136264301

Test: Set up work profile on device, repeatedly do the following
      1) Go to settings, enroll face
      2) Back out, go back in, delete face
      3) Enroll face
      4) Delete face, go back out

Change-Id: Ic32587cd4613f2bfd71171df6b69fe6028812ca8