Make ManagedProvisioning hide non-system overlays

This is to prevent tapjacking where an app obscures the
provisioning activity and tricks the user into inflating a work
profile without consent.

Bug: 209611539
Test: manual
Change-Id: I4bda57bd80f34402e0a63554e719dceda60a296f
Merged-In: I4bda57bd80f34402e0a63554e719dceda60a296f