security: prevent FDE after PFE

Full-Disk-Encryption (FDE) is not allowed
after Per-File-Encryption (PFE) is activated.

Change-Id: I17e6039f3b33450835fea6ee5e612c079868b71f