DO NOT MERGE - Cherry picking from master to MR1

Fix 5783857: Device Policy Manager doesn't allow Face Unlock

This makes it so that if face unlock is enabled and then a device policy
manager that requires something more secure than face unlock is installed,
the user will be forced to choose a new acceptable lock type.

This was previously fixed for the case where the device had been reset, or
the shell was restarted after setting face unlock, but not for the case where the
device remained on between setting face unlock and setting up a device policy
manager.

Also changed the function ordering of saveLockPattern() so that the overloaded
wrapper function is next to the main function.

Change-Id: Ibed8c4ab137ebbc07fb143faef6f047bc6dc4474