Don't drop as many caches when evicting CE key

When a user's CE key is removed, write "2" to /proc/sys/vm/drop_caches
rather than "3".  This avoids unnecessarily evicting the pagecache of
in-use inodes.  It's only necessary to evict the inodes of the relevant
encrypted files, and these are already sync'ed and no longer in-use.
For this mode "2" suffices, as this evicts "reclaimable slab objects",
including inodes; and evicting an inode implies evicting its pagecache.

This matches the recommendation I've made in the documentation for the
fscrypt kernel feature at
https://www.kernel.org/doc/html/latest/filesystems/fscrypt.html#online-attacks

Test: Sanity check that directories are still "locked" properly:
      Unlock device with PIN.  Then in adb shell: 'stop; start;
      sleep 10; ls /data/data/' still shows filenames in ciphertext form.
Change-Id: I1bdf3c420ebf63e98cc314498211061ea36f2942