Hook onUserUnlocked to verify no response packages

Old v1 verification agents will not be boot aware, and thus cannot
begin boot time verification until the user unlocks their device. To
support them, this sends the broadcast once the user is unlocked and
decrypted credential storage is available.

The boot broadcast is maintained in case the verification agent is
somehow direct boot aware, allowing it to start verification as soon
as possible. It's expected that de-duplication and network response
caching by the verification agent will make this double send low
impact.

Bug: 178864286

Test: manual boot device with no verified packages with a v1 verifier

Change-Id: Id41306baeb3f94d4e709cf60dbfbc40e69cd1686