AudioService: fix broadcast of ACTION_SPEAKERPHONE_STATE_CHANGED

When broadcasting ACTION_SPEAKERPHONE_STATE_CHANGED:
- clear calling identity
- send to all users

Bug: 129871987
Test: see bug
Change-Id: I7dbe68a179d3012f1c38d866e8528eed25e109e6

services/core/java/com/android/server/audio/AudioService.java

@@ -3361,8 +3361,14 @@ public class AudioService extends IAudioService.Stub
                 .append(Binder.getCallingPid()).toString();
         final boolean stateChanged = mDeviceBroker.setSpeakerphoneOn(on, eventSource);
         if (stateChanged) {
-            mContext.sendBroadcast(new Intent(AudioManager.ACTION_SPEAKERPHONE_STATE_CHANGED)
-                    .setFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY));
+            final long ident = Binder.clearCallingIdentity();
+            try {
+                mContext.sendBroadcastAsUser(
+                        new Intent(AudioManager.ACTION_SPEAKERPHONE_STATE_CHANGED)
+                                .setFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY), UserHandle.ALL);
+            } finally {
+                Binder.restoreCallingIdentity(ident);
+            }
         }
     }