Don't re-trigger face auth from notification shade

Adds a condition to shouldListenForFace() that checks whether the
notification shade is in the locked state. This should prevent it from
re-triggering after previous authentication attempts (which seems to
have happened in b/155223318).

Test: atest KeyguardUpdateMonitorTest
Test: Unable to repro issue. Manually verified that unlocking from
notification shade still works.

Fixes: 155223318
Change-Id: Ibddb10e8f14d7bcbaa45d8471cca02719f6f758f