Allow device owner to inflate managed profile

1. Modify DPM.isProvisioningAllowed to allow it to happen
2. Introduce hidden API createProfileForUserEvenWhenDisallowed for
   ManagedProvisioning app to create profile under DO.
   Apps with MANAGE_USERS permission can clear the
   DISALLOW_ADD_USER restriction anyway, so they do not gain extra power.

Test: runtest -x frameworks/base/services/tests/servicestests/src/com/android/server/pm/UserManagerTest.java
Test: cts-tradefed run cts --module DevicePolicyManager --test com.android.cts.devicepolicy.CustomDeviceOwnerTest#testIsProvisioningAllowed

Bug: 31895999

Change-Id: I10dc3043653130ae717a1d3d8256c9e73231bb21