Move key eviction past system services user cleanup.

This ensures that all system services release all handles to
user key encrypted data before the key is evicted.

Bug:63257991
Test: Turning work profile off and attempting to read profile files.
Change-Id: I9b158b9b551fd6b8e5e885baff96485bff1a5478

services/core/java/com/android/server/am/UserController.java

@@ -671,12 +671,6 @@ final class UserController {
         }
 
         if (stopped) {
-            // Evict the user's credential encryption key
-            try {
-                getStorageManager().lockUserKey(userId);
-            } catch (RemoteException re) {
-                throw re.rethrowAsRuntimeException();
-            }
             mInjector.systemServiceManagerCleanupUser(userId);
             synchronized (mLock) {
                 mInjector.getActivityStackSupervisor().removeUserLocked(userId);
@@ -685,6 +679,12 @@ final class UserController {
             if (getUserInfo(userId).isEphemeral()) {
                 mInjector.getUserManager().removeUser(userId);
             }
+            // Evict the user's credential encryption key.
+            try {
+                getStorageManager().lockUserKey(userId);
+            } catch (RemoteException re) {
+                throw re.rethrowAsRuntimeException();
+            }
         }
     }