Enable device disabling during normal operation

Enable device disabling during normal operation

This CL enables device disabling during normal operation: The
management server can disable a device by sending the device disabled
flag with the next device policy update. The server can re-enable the
device by clearing the flag with a future policy update.

The flag is persisted along with the entire device policy blob on the
device. As long as the flag is set, the device will prevent logins and
will show a device disabled screen instead. When the flag first
becomes set, the device terminates the current session (if any) and
switches to the device disabled screen immediately.

BUG=425574
TEST=New unit and browser tests

Review URL: https://codereview.chromium.org/711433002

Cr-Commit-Position: refs/heads/master@{#303241}