Restrict Carrier Wifi while VCN is configured & privileged

This change removes the NOT_RESTRICTED capability for Carrier Wifi. This
is done even if a VCN is in safe mode, but will ONLY be performed if the
VCN is provisioned, and has the appropriate carrier privileges to run.

This change also fixes a test bug where the NOT_VCN_MANAGED capability
was not present in the query to getUnderlyingNetworkPolicy(), and
therefore was incorrectly passing.

Bug: 163432273
Test: atest FrameworksVcnTests
Change-Id: Iecb827b5341bdeb93ef8692c1d62f0eaf9d416ba