28/n: Move authenticatorId update to RemovalClient

When the last biometric is removed for a user, the authenticatorId
must be changed to 0. This CL moves the logic into RemovalClient.
Note that multiple things can cause a biometric to be removed (user
remove from settings, or internal cleanup for mismatched templates).
RemovalClient is the common code path for all of this.

Bug: 157790417
Test: Enroll fingerprint, remove fingerprint, see authenticatorId
      updated to 0
Change-Id: I5539d311f8f7ced9d8cfc13f64a10583e487cb28