17/n: Make generateChallenge/revokeChallenge ClientMonitors

As part of the move to make all HAL operations a ClientMonitor,
this change makes generateChallenge return the challenge via a
callback.

Added generateChallengeBlocking() so that existing synchronous clients
can continue to work with minimal changes (only renaming is necessary),
and so that it's explicit that the call may take some time (up to
hundreds of milliseconds on some devices).

1) LockSettingsService#resetLockout path
2) Fingerprint/Face enroll path

Bug: 157790417
Test: Enroll on fingerprint/face devices
Test: ResetLockout on fingerprint/face devices

Change-Id: I99efc1c72c8ac994c56d6d2deaf3e0131e5b2dac