Disallow shell to mutate always-on vpn when DISALLOW_CONFIG_VPN user restriction is set

Fix: 29899712

Change-Id: I38cc9d0e584c3f2674c9ff1d91f77a11479d8943
(cherry picked from commit 9c7b706cf4332b4aeea39c166abca04b56685280)
