Run biometric cleanup on user switch.

This will force the new to user start on the scheduler, open a new session, and close the old user's session in the HAL.

Add a similar user swtich hook to keyguard to refresh the lockout state. Note that lockout behavior is still ill-defined (b/225986544) and HALs may not support a lockout state per user.

Bug: 205908931
Test: manual (unlock, cause lockout, & switch users)
Test: atest KeyguardUpdateMonitorTest

Change-Id: I89d3d7454894bc5caa0cac33e96d7fd0d61e9083