Merge \"Disallow shell to mutate always-on vpn when DISALLOW_CONFIG_VPN user restriction is set\" into nyc-mr1-dev
am: e05b35db0d

Change-Id: I0b47bc6184ee3b4b9ac4783decf4c8cd30b70fbd