[VPN] start lockdown before user is unlocked

Removed the dependency on KeyStore encryption by removing that flag for
VPN profiles which don't use secure credentials when saving in Settings.

Old encrypted profiles will simply fail to load untile USER_PRESENT is
sent, as before.

Bug: 26108660
Change-Id: I2677d741d54252f15cb772c94ce1b39041f1e19c