[udc-staging] Mitigate BAL bypass via Companion Device Manager

Combine short-term mitigation and unconditional enforcement:
Ensure calling UIDs attempting CDM association are in
PROCESS_STATE_TOP, unconditionally throwing SecurityException
if called from background without requiring flag gating.

Bug: 525133623
Test: atest CtsCompanionDeviceManagerCoreTestCases:AssociateTest
Flag: EXEMPT FLAG_REMOVAL
TAG=agy
CONV=35cc9e58-da54-4bea-bb66-b785f7572b20
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:63837de3bbc5a78acc36600c567d31061cdc9f79
Merged-In: Ie355fdf7d74ae3a5918fb6451f46757fff0d3c08
Change-Id: Ie355fdf7d74ae3a5918fb6451f46757fff0d3c08