Show Toast on applying SensitiveContentProtection

This happens on two paths:
* Window already visible: When the SensitiveContentProtection system
  service adds a new window/app into the protected list, find all
  visible windows and Toast for any that are protected. This also covers
  the case where projection is started after the window is visible.
* Window becomes visible: Notify WMS and Toast if the window is in the
  protected list.

We can't reuse the approach taken for recording detection callbacks to
listen for visibility changes since that works at an app-level, while
we need window-level visibility events. Also the new approach handles
non-Activity windows.

The logic is kept in WMS since it holds both the protected list and the
visibility of windows. Additionally, this works better for applying the
Toast to FLAG_SECURE windows in the future (for a consistent UX).

Fixes: 323580163
Test: manual - for both login and otp-app hiding: trigger protection
 after window is shown; minimize app and re-open.
Test: manual - send OTP to bubble conversation and expand bubble
Test: atest CtsSensitiveContentProtectionTestCases
Change-Id: If6628b445d6351160c66ff89411f798ce44bf770