Merge changes from topic "docheckfix9"

* changes:
  Add DISALLOW_ADD_USER to all users when Device Owner is set.
  Make getUserProvisioningState work cross-user.
  Fix Connected Apps on headless
  Update canAdminGrantSensorsPermissions to always check system user.