Clear DISALLOW_ADD_USER user restriction when dpm remove-active-admin is called from shell

- Make the CTS hermetic and not adding new restriction after CTS test
- DeviceOwner can't clear this user restriction in CTS, as it's set by ManagedProvisioning
- It can be only clear when testOnly DPC becomes deviceOwner, and being removed by remove-active-admin in shell

Bug:31856203
Test: build successfully

Change-Id: I75b91629ef09c54e9dbe7253df6a52894a938e83

services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java

@@ -3093,6 +3093,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
                 // If admin is a device or profile owner tidy that up first.
                 if (isDeviceOwner(adminReceiver, userHandle)) {
                     clearDeviceOwnerLocked(getDeviceOwnerAdminLocked(), userHandle);
+                    clearDeviceOwnerUserRestrictionLocked(UserHandle.of(userHandle));
                 }
                 if (isProfileOwner(adminReceiver, userHandle)) {
                     final ActiveAdmin admin = getActiveAdminUncheckedLocked(adminReceiver,
@@ -3108,6 +3109,15 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         }
     }
 
+    // It's temporary solution to clear DISALLOW_ADD_USER after CTS
+    // TODO: b/31952368 when the restriction is moved from system to the device owner,
+    // it can be removed.
+    private void clearDeviceOwnerUserRestrictionLocked(UserHandle userHandle) {
+        if (mUserManager.hasUserRestriction(UserManager.DISALLOW_ADD_USER, userHandle)) {
+            mUserManager.setUserRestriction(UserManager.DISALLOW_ADD_USER, false, userHandle);
+        }
+    }
+
     /**
      * Return if a given package has testOnly="true", in which case we'll relax certain rules
      * for CTS.