Move VPN restriction check into setup dialog

The purpose of DISALLOW_CONFIG_VPN is to stop users from configuring
VPN, not from using it at all.

The key difference being that if the admin already enforced a VPN then
that setting should be respected (but it still shouldn't be tamperable).

Bug: 28733079
Change-Id: Ib8cab5657a9d5819a019093da3812cd8c2ca4050