[25Q2] Mitigate BAL bypass via Companion Device Manager

Combine short-term mitigation and unconditional enforcement:
Ensure calling UIDs attempting CDM association are in
PROCESS_STATE_TOP, unconditionally throwing SecurityException
if called from background without requiring flag gating.

Bug: 525133623
Test: atest CtsCompanionDeviceManagerCoreTestCases:AssociateTest
Flag: EXEMPT FLAG_REMOVAL
TAG=agy
CONV=35cc9e58-da54-4bea-bb66-b785f7572b20
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:9d225e2295caac3ac1a12b9c9a4cc4982dc95ad0
Merged-In: Ie355fdf7d74ae3a5918fb6451f46757fff0d3c08
Change-Id: Ie355fdf7d74ae3a5918fb6451f46757fff0d3c08