Persist face error message for permanent lockout

Fixes the existing Keyguard and FaceService logic to correctly check for
and show a persistent error message when face authentication is in
permanent lockout mode due to too many failed attempts.

Test: atest com.android.keyguard
Test: On Pixel 4/4XL, fail face auth 6+ times on lock screen

Before: Error message shown after 5th attempt, but not future attempts

After: Error message shown after 5th and all subsequent attempts

Fixes: 140134198
Change-Id: I9d43f156c056c10f7176146c4709a734653689ac
diff --git a/services/core/java/com/android/server/biometrics/face/FaceService.java b/services/core/java/com/android/server/biometrics/face/FaceService.java
index a0573db..b512475 100644
--- a/services/core/java/com/android/server/biometrics/face/FaceService.java
+++ b/services/core/java/com/android/server/biometrics/face/FaceService.java
@@ -962,9 +962,10 @@
         @Override
         public void onLockoutChanged(long duration) {
             Slog.d(TAG, "onLockoutChanged: " + duration);
+
             if (duration == 0) {
                 mCurrentUserLockoutMode = AuthenticationClient.LOCKOUT_NONE;
-            } else if (duration == Long.MAX_VALUE) {
+            } else if (duration == -1 || duration == Long.MAX_VALUE) {
                 mCurrentUserLockoutMode = AuthenticationClient.LOCKOUT_PERMANENT;
             } else {
                 mCurrentUserLockoutMode = AuthenticationClient.LOCKOUT_TIMED;