Otherwise it's pretty easy to circumvent any future restrictions by
keeping VPN settings for a particular app open and continuing to use
it even after DISALLOW_CONFIG_VPN is applied.
Two checks:
1) in onResume (catches almost every case)
2) in setAlwaysOn (catches every remaining case)
Bug: 28733079
Change-Id: I1c67bb14891ef620df5ed65fbd32678e417b4a65