Merge \"Disallow shell to mutate always-on vpn when DISALLOW_CONFIG_VPN user restriction is set\" into nyc-dev
am: 488042fe3b

Change-Id: Ia41b8b2acbe3897423ac27881f3419efcfeeb002