Merge changes from topic "protectedPackages"

* changes:
  Allow non-DPC admins to use DeviceAdminService
  Give precedence to protectedPackages set locally
  Resolve policies that could be set locally and globally