Implement VirtualDevice's device policy enforcement

The policy defined in DevicePolicyManager.getNearbyAppStreamingPolicy
is implemented in this change. The policy in each profile defines its
own behavior. For example, if a work profile sets the policy as ENABLED,
activities for the work profile can be started on virtual displays
created for the parent (personal) profile as well.

If the policy is SAME_MANAGED_ACCOUNT_ONLY, VirtualDeviceManager will
compare whether the UserHandle associated with the activity is listed as
"usersWithMatchingAccounts", which is supplied by the virtual device
owner.

If usersWithMatchingAccounts is not given, it is treated the same way as
an empty list, in which case SAME_MANAGED_ACCOUNT_ONLY policy has the
same behavior as DISABLED.

Bug: 179910177
Test: To be added in ag/15781910
Change-Id: I0d89aaafecdc579482a38ee8c0bff0cc300d4f41