Merge "Disallow shell to mutate always-on vpn when DISALLOW_CONFIG_VPN user restriction is set" into nyc-dev