Update direct boot related documentation.

Also hide a few APIs as requested by council.  Add a method to
easily determine if a given File would already be encrypted at rest
by the OS.

Bug: 27531029
Change-Id: Icad5f1cd56411ad3ac707db85fd7449acdcc4b94