Do not remove the k_k until all users are unlocked

The key in keystore is used to encrypt the escrow data. We need to
iterate over all users before deleting it from key store. Otherwise,
the RoR for the 2nd user will fail.

Bug: 172780686
Test: atest CtsAppSecurityHostTestCases:ResumeOnRebootHostTest#resumeOnReboot_TwoUsers_BothUserUnlock_Success
Change-Id: I82d94195fe5716d42e363604be5ead3eb3e300fd

services/core/java/com/android/server/locksettings/RebootEscrowManager.java

@@ -224,6 +224,10 @@ class RebootEscrowManager {
         for (UserInfo user : rebootEscrowUsers) {
             allUsersUnlocked &= restoreRebootEscrowForUser(user.id, escrowKey, kk);
         }
+
+        // Clear the old key in keystore. A new key will be generated by new RoR requests.
+        mKeyStoreManager.clearKeyStoreEncryptionKey();
+
         onEscrowRestoreComplete(allUsersUnlocked);
     }
 
@@ -273,9 +277,6 @@ class RebootEscrowManager {
         } catch (IOException e) {
             Slog.w(TAG, "Could not load reboot escrow data for user " + userId, e);
             return false;
-        } finally {
-            // Clear the old key in keystore. A new key will be generated by new RoR requests.
-            mKeyStoreManager.clearKeyStoreEncryptionKey();
         }
     }