[24Q3] Mitigate BAL bypass via Companion Device Manager

Combine short-term mitigation and unconditional enforcement:
Ensure calling UIDs attempting CDM association are in
PROCESS_STATE_TOP, unconditionally throwing SecurityException
if called from background without requiring flag gating.

Bug: 525133623
Test: atest CtsCompanionDeviceManagerCoreTestCases:AssociateTest
Flag: EXEMPT FLAG_REMOVAL
TAG=agy
CONV=35cc9e58-da54-4bea-bb66-b785f7572b20
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:35c87b62ed11c7ae4138680f0fc3e5c025e5742e
Merged-In: Ie355fdf7d74ae3a5918fb6451f46757fff0d3c08
Change-Id: Ie355fdf7d74ae3a5918fb6451f46757fff0d3c08