Permission Check For DPM.isDeviceProvisioned

Require the caller of DPM.isDeviceProvisioned() to hold the MANAGE_USERS
permission.  The only callers should be within the framework itself, or
apps involved in device provisioning which already hold this permission.

Bug: 62343414
Test: Set TestDPC as Device Owner and use it to reset password
Test: com.android.server.devicepolicy.DevicePolicyManagerTest
Test: com.android.server.locksettings.LockSettingsServiceTests
Test: com.google.android.gts.devicepolicy.DevicePolicyManagerTest
Change-Id: Ie53deb5ba8679a5b431f2a8da60ec9710c44d56f