Allow COPE DPC to confirm compliance explicitly

Currently when COPE PO sets a maximum managed profile time off
policy, it is sufficient for the user to turn the profile on
briefly to reset the timer, which technically allows the user
to circumvent the policy, doing so repeatedly.

With this change DPC can control when the timer gets reset by
acknowledging compliance explicitly.
By default, the behavior is the same as before unless the DPC
overrides DAR#onComplianceAcknowledgementRequired in which case
it will have to call DPM.acknowledgeDeviceCompliant when the
timer can be safely reset, e.g. after a successful policy sync.

Bug: 181943978
Test: atest OrgOwnedProfileOwnerTest#testWorkProfileMaximumTimeOff_complianceRequiredBroadcastDefault
Test: atest OrgOwnedProfileOwnerTest#testWorkProfileMaximumTimeOff_complianceRequiredBroadcastOverride
Test: atest OrgOwnedProfileOwnerTest#testWorkProfileMaximumTimeOff
Test: atest com.android.server.devicepolicy.DevicePolicyManagerTest
Change-Id: I6efea53aad8097c047f1e3ebf62b421dc32214e6