Don't allow enabling system decorations for untrusted virtual displays (1/2)

We should only allow enabling system decorations for callers with the
right permission.

Bug: 130284250
Test: atest MultiDisplaySystemDecorationTests
Test: atest MultiDisplayPolicyTests
Test: atest ActivityManagerGetConfigTests#testDeviceConfigWithSecondaryDisplay
Test: atest MultiDisplayActivityLaunchTests#testLaunchExternalDisplayActivityWhilePrimaryOff
Change-Id: I008d44bdf1378a675a3197e1467521dcf7b275c5