Merge changes I0ac2d766,I198371b6 into main

* changes:
  Filter out work profile widgets when not allowed by device policy
  Allow disabling keyguard widgets for work profile