android: Make a certificate alias pre-selectable in managed profiles

android: Make a certificate alias pre-selectable in managed profiles

This allows associating a pre-installed certificate/key with a VPN
profile.  For instance, one locally generated on the device via
SCEP/ETS by the MDM.  It only works if the app is granted access to the
certificate/key (alias) by the MDM.

For now, users may still select a different certificate if one is
available (since this requires the certificate to be installed as
user-selectable there might not be).