Send LOCKED_BOOT_COMPLETED on same queue as BOOT_COMPLETED

Make sure that the LOCKED_BOOT_COMPLETED broadcast is dispatched via the
same delivery queue as BOOT_COMPLETED.  Currently, it's possible for an
app to receive the two broadcasts in reverse order, which violates the
start sequence contract.

Bug: 149030767
Test: boot & observe LOCKED_BOOT_COMPLETED / BOOT_COMPLETED history
Change-Id: Ib44d53a0c97a24ec648e1d9c9057464f6cb331d8

services/core/java/com/android/server/am/UserController.java

@@ -414,6 +414,7 @@ class UserController implements Handler.Callback {
                 Intent intent = new Intent(Intent.ACTION_LOCKED_BOOT_COMPLETED, null);
                 intent.putExtra(Intent.EXTRA_USER_HANDLE, userId);
                 intent.addFlags(Intent.FLAG_RECEIVER_NO_ABORT
+                        | Intent.FLAG_RECEIVER_OFFLOAD
                         | Intent.FLAG_RECEIVER_INCLUDE_BACKGROUND);
                 mInjector.broadcastIntent(intent, null, resultTo, 0, null, null,
                         new String[]{android.Manifest.permission.RECEIVE_BOOT_COMPLETED},