Merge "Put disallow-safe-boot restriction to system settings to make it accessible during boot." into nyc-dev