Merge "Enable device management role holder to set app restrictions" into main