Add API to limit maximum time the profile can be turned off.

If this policy is set:
* Whenever work profile gets turned off or system boots, timer is
  started, so theat unless the profile is unlocked in time, apps
  will be suspended.
* when the user is unlocked, alarm is discharged.

Currently there is no upfront warning notification, will be addressed
in a follow-up.

Bug: 143517719
Test: manual, using TestDPC
Change-Id: Ib0f936b6d1414f65ae8c86367b7059c14862827d