Support profile global restrictions in disclosure messages.

Starting from Android O ENSURE_VERIFY_APPS can be enforced globally
by profile owners. To take this into account, this CL uses newer
UserManager API for getting a list of enforcing admins with their
userIds instead of just a mask.

Bug: 37158436
Test: manually
Change-Id: Id18b365668373b5aa28d59fcc4d662a2f5d133d8