Add permission checks to unified challenge cache APIs

While it shouldn't be possible to do anything "bad" with these APIs,
they should require the ACCESS_KEYGUARD_SECURE_STORAGE permission just
like most other APIs in LockSettingsService.  This doesn't break the
legitimate users, both of which use Binder.clearCallingIdentity():

- tryUnlockWithCachedUnifiedChallenge() is only called by
  UserManagerService.requestQuietModeEnabled().

- removeCachedUnifiedChallenge() is only called by
  LockSettingsShellCommand ('locksettings remove-cache').

Bug: 239050838
Change-Id: Ib7224729c3e110aa44f0416f72063b38517ed089

services/core/java/com/android/server/locksettings/LockSettingsService.java

@@ -2940,6 +2940,7 @@ public class LockSettingsService extends ILockSettings.Stub {
 
     @Override
     public boolean tryUnlockWithCachedUnifiedChallenge(int userId) {
+        checkPasswordReadPermission();
         try (LockscreenCredential cred = mManagedProfilePasswordCache.retrievePassword(userId)) {
             if (cred == null) {
                 return false;
@@ -2951,6 +2952,7 @@ public class LockSettingsService extends ILockSettings.Stub {
 
     @Override
     public void removeCachedUnifiedChallenge(int userId) {
+        checkWritePermission();
         mManagedProfilePasswordCache.removePassword(userId);
     }