Document access to device identifiers on managed devices

Document when, on a managed device or profile, the DPC can
read hardware identifiers, and when it must use the new
enrollment-specific ID.

Bug: 172636282
Test: m docs
Change-Id: I783725853d0654d49518a38d8d8d04b3ca7e3ab0