Do not run device entry face auth when keyguard is not showing

                                                                                                                                                                   Other changes:
 - Reduce hardware error retry count to 5 (unresolved comment in another CL)

Fixes: 283077185
Fixes: 285495324
Test: atest DeviceEntryFaceAuthRepositoryTest
Test: verified manually that the current triggers are not impacted.
Change-Id: I54d799795cbd224b9a16978ed9c2bf5b2514e0ba