Clarify lockNow usage from a managed profile

lockNow can be used by the profile owner of a managed profile both to
lock all users and evict the encryption key of the managed profile.

However, the order of calls is important. Document the order in which
lockNow need to be called on the parent DevicePolicyManager instance so
that the profile owner isn't stopped prior to locking all users.

Bug: 148067606
Test: m docs
Change-Id: I3e29e8cb02b74d41ef4f5d96467937149282cc07