VCN: Allow restricting TRANSPORT_TEST for CTS

This commit updates VCN to be able to mark a test network
as restricted. Additionally, when VCN is in safe mode, VCN will
delegate to the Android system to decide the restriction policy of
the test network.

This commit allows CTS to verify VCN's ability of restricting
networks based on the transport type.

Bug: 263415068
Test: atest VcnManagerTest (new tests)
Change-Id: I5fe0be4ce445a4d9c20cbef5ee4a2eb55403b3c8