Do not allow -1 duration in setUserAuthenticationParameters

This is a completely new API so callers can follow the new pattern of
using 0 to require auth for every use of the key.

Supporting both -1 and 0 to require auth for every use of the key
increases CtsVerifier complexity exponentially (strongbox,
invalidated by enrollment, etc).

Fixes: 150823346
Test: builds
Change-Id: Ieef53a8b50f5119c5e52656e930bf16b1e8e3d89