Allow CREATE_USERS for removeUserOrSetEphemeral

The removeUserOrSetEphemeral() API currently requires the
MANAGE_USERS permission, whereas removeUser() requires either
MANAGE_USERS OR CREATE_USERS.

As documented in the CREATE_USERS permission declaration, it allows an
application to create or remove users and endow them with the ephemeral
property. The empeheral flag is explicitly supported in
UserManagerService#ALLOWED_FLAGS_FOR_CREATE_USERS_PERMISSION.

Bug: 155913815
Bug: 172247872
Test: atest EphemeralTest # on a user build
Change-Id: I6cec670bd9b43c9fe8a16dbf28e394ac22118d37