MDM: enforce app protection (biometric/faceid)

have a new option/flag/toggle "enforce_protection"
when set on first startup set up app protection
when set meanwhile (e.g. after x weeks) -> also enforce it
do not allow to disable setting
change password is still possible