DPM Check for unaffiliated secondary users

* Add authorization check in DPMS for API
  methods to set the private DNS mode and
  the recommended global proxy.
* When there is a unaffiliated user, it is
  assumed that it is managed separately.
* These are device-wide policies that affect
  all users, so should only be set when it is
  the same managing entity and all users on
  the device are affiliated.

Bug: 177926343
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
      atest com.android.cts.devicepolicy.DeviceOwnerTest#testProxyPacProxyTest
      atest com.android.cts.devicepolicy.DeviceOwnerTest#testProxyStaticProxyTest
Change-Id: I119a84988ad3cda42b709dbc6d63acf76b0031d6