Merge "Always set CE key protection in migrateUserToSpWithBoundKeysLocked()" into main