Add restrictions on underlying networks with VcnConfig

This commit allows VCN callers to configure underlying networks
that need to be restricted via VcnConfig.

This commit also makes sure that VCN will notify policy listners
when the VcnConfig gets updated.

Bug: 239104955
Test: atest FrameworksVcnTests(new tests)
Test: atest CtsVcnTestCases
Change-Id: Ie174f7ec27ba115939c4f5d88d9bb00c6d348ea9