Our original plan was to disable both authenticators by default, and enable
one of then on boot. However, it turned out existing exchange accounts will
be removed if there's no enabled authenticators for the account type.
So, instead, in this patch we initially enable only the default one, and switch
to the other one on boot if the vendor policy indicates so.
(If a device has a vendor policy apk, it should also have the email app
preloaded, so changing the label at boot time isn't too late.)
Bug: 2382710
