Show policy icon when crostini disallowed by policy

In addition to the kUserCrostiniAllowedByPolicy preference, there are
two other ways in which Crostini can be disallowed by policy:
unaffiliated user restrictions, and by disallowing virtual machines.
This CL changes the behavior of the Linux row in Chrome Settings so that
it shows a policy indicator icon & disables the "turn on" button when
Crostini is disallowed by one of these factors.

Change-Id: Iac6f3ca4c98be74308cb4177eadfb34c1d92d635
Reviewed-on: https://chromium-review.googlesource.com/c/1325594
Commit-Queue: Renée Wright <rjwright@chromium.org>
Reviewed-by: Nicholas Verne <nverne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#613438}

chrome/browser/chromeos/crostini/crostini_util.cc

@@ -217,18 +217,11 @@ bool IsCrostiniAllowedForProfileImpl(Profile* profile) {
       chromeos::ProfileHelper::IsLockScreenAppProfile(profile)) {
     return false;
   }
-  const user_manager::User* user =
-      chromeos::ProfileHelper::Get()->GetUserByProfile(profile);
-  if (!user->IsAffiliated() &&
-      !crostini::IsUnaffiliatedCrostiniAllowedByPolicy()) {
-    return false;
-  }
   if (!crostini::CrostiniManager::IsDevKvmPresent()) {
     // Hardware is physically incapable, no matter what the user wants.
     return false;
   }
   return virtual_machines::AreVirtualMachinesAllowedByVersionAndChannel() &&
-         virtual_machines::AreVirtualMachinesAllowedByPolicy() &&
          base::FeatureList::IsEnabled(features::kCrostini);
 }
 
@@ -241,10 +234,18 @@ void SetCrostiniUIAllowedForTesting(bool enabled) {
 }
 
 bool IsCrostiniAllowedForProfile(Profile* profile) {
+  const user_manager::User* user =
+      chromeos::ProfileHelper::Get()->GetUserByProfile(profile);
+  if (!user->IsAffiliated() && !IsUnaffiliatedCrostiniAllowedByPolicy()) {
+    return false;
+  }
   if (!profile->GetPrefs()->GetBoolean(
           crostini::prefs::kUserCrostiniAllowedByPolicy)) {
     return false;
   }
+  if (!virtual_machines::AreVirtualMachinesAllowedByPolicy()) {
+    return false;
+  }
   return IsCrostiniAllowedForProfileImpl(profile);
 }