ConnectivityDiagnosticsCallbacks should only be invoked for the underlying networks declared by active VPNs. This encourages VPN apps to declare their underlying networks. The previous permission model for VPNs allowed active VPNs to receive callbacks on any network. Bug: 148903617 Test: atest FrameworksNetTests Change-Id: Ic08cdd2e2532580fda0fd3034e2bdff27e0ff84b