Auto-call prepare() for new always-on VPNs

Existing VPN apps don't tend to call prepare() inside their VpnService
(they usually do that much earlier) so this eases the migration path
quite a bit and gives the networking system an advance cue as to which
app is about to take over.

Bug: 26891808
Change-Id: Ibda40d11a7e6fa3e764c18fcc4d502c1a4959f9b