isRestrictedProfile() allowed for QUERY_USERS

`isRestrictedProfile()` currently requires CREATE_USERS or MANAGE_USERS, but doesn't accept QUERY_USERS. This is inconsistent because it's really a query-type API, and also because the same information can be inferred from `getRestrictedProfileParent()` which already accepts QUERY_USERS. So we make it consistent.

Bug: 272303195
Change-Id: I3071c059665486dc7cde2a2da59bca40fc16d830
Test: builds