Allow MANAGE_TEST_NETWORKS to register limited agents

This puts in force some restrictions against test networks,
and in exchange relaxes the restrictions around registering
a network agent that provides a test network.
Test networks can only ever have transport TEST, and have
only a few capabilities available to them.

This is useful in particular to test CTS. See aosp/1253423
for first, basic usage of this capability.

Test: IpSecManagerTunnelTest
Test: new CTS aosp/1253423
Bug: 139268426
Change-Id: I47600e6097e8519e50ae771daa13bb6bb7640451