Docs: Note that DISALLOW_CONFIG_VPN stops VPNs from starting

VPNs don't start except a DPC's configured always-on VPN. Clarified version behaviors.
Staged at: go/dac-stage/reference/android/os/UserManager.html#DISALLOW_CONFIG_VPN

Test: make ds-docs and output staged UserManager page
Bug: 63582789
Change-Id: I83c0c6cc580b9d1d224a94e073f559f23cf4d672
(cherry picked from commit 1f83e4d498f4a4f2c8796cdefe330a4caf258424)
diff --git a/core/java/android/os/UserManager.java b/core/java/android/os/UserManager.java
index 79a67fe..de0d5d76 100644
--- a/core/java/android/os/UserManager.java
+++ b/core/java/android/os/UserManager.java
@@ -303,10 +303,12 @@
     public static final String DISALLOW_DEBUGGING_FEATURES = "no_debugging_features";
 
     /**
-     * Specifies if a user is disallowed from configuring VPN.
-     * The default value is <code>false</code>.
-     * This restriction has an effect in a managed profile only from
-     * {@link android.os.Build.VERSION_CODES#M}
+     * Specifies if a user is disallowed from configuring a VPN. The default value is
+     * <code>false</code>. This restriction has an effect when set by device owners and, in Android
+     * 6.0 ({@linkplain android.os.Build.VERSION_CODES#M API level 23}) or higher, profile owners.
+     * <p>This restriction also prevents VPNs from starting. However, in Android 7.0
+     * ({@linkplain android.os.Build.VERSION_CODES#N API level 24}) or higher, the system does
+     * start always-on VPNs created by the device or profile owner.
      *
      * <p>Key for user restrictions.
      * <p>Type: Boolean