Move DO protected packages to ActiveAdmin

This is needed to allow POs to use this policy.

After this change PackageManagerInternal isn't updated when
transferring ownership, and thus retains the old DPC package
in its map. This will be addressed in the next CL on the
package manager side: owner package -> protected packages map
will be replaced with one keyed by userId, so such update won't
be necessary.

Bug: 218639412
Test: atest com.android.server.devicepolicy
Test: atest UserControlDisabledPackagesTest
Test: atest DeviceOwnerTest#testSetUserControlDisabledPackages_singleUser_reboot_verifyPackageNotStopped
Change-Id: I19c568461fdb4b341c9e3d4e7e101c859af176b6