Wire up lifecycle, send unlocked broadcast.

When the correct lock pattern is presented, ask the system to also
unlock credential-encrypted storage, if enabled.  The token passed
along is empty for now, but can be wired up to gatekeeper in the
future.

During each system boot, ask vold to lock all users keys to give us
a known starting state.  This also has the effect of chmod'ing away
any CE data when in emulation mode.

Define and send a new foreground broadcast when the CE storage is
unlocked for the first time.  Add stronger last-ditch checking for
encryption-awareness before starting an app.

Bug: 22358539
Change-Id: Id1f1bece96a2b4e6f061214d565d51c7396ab521