Fix bugs in user restriction migration

Originally I didn't know user-0 could have PO, so I excluded this case
from migration.  Now we handle it properly.

Also make sure only restrictions that can actually be set by each
owner moves to the owner restriction.  (Because of this, we no longer
have to have DISALLOW_WALLPAPER in the exception list, because
owners can't set DISALLOW_WALLPAPER.)

Bug 27225996

Change-Id: I6ad79d90e6c4400abbb1e4feba6ba59e3b650815