Merge "Move escrow APIs into LockSettingsInternal" into pi-dev