Let admin disable fingerprint for the work challenge
Also, reworked the logic a bit:
* Admins can only set flags that affect the parent on the
parent DPM instance (i.e. no unredacted notifications)
* Admins can set flags not supported on the work challenge on
the regular DPM instance. If there is a work challenge,
they will have no effect (as managed profile policies don't
affect the regular lockscreen if there is a work challenge).
If there is no work challenge, they'll affect the parent profile.
Bug:
26891832
Change-Id: I8978e1aa6abe9c8dc07e030dfd069b5f4e1301f6