Add a SigninAllowed policy.

chrome/browser/profiles/profile.cc

Index: chrome/browser/profiles/profile.cc
diff --git a/chrome/browser/profiles/profile.cc b/chrome/browser/profiles/profile.cc
index 804bcf48fdf836f1fb9587b7ff54aaad12bf1edd..f68c24c48d2fa623806af230d4bc204435bb9d8a 100644
--- a/chrome/browser/profiles/profile.cc
+++ b/chrome/browser/profiles/profile.cc
@@ -130,6 +130,9 @@ bool Profile::IsGuestSession() const {
 }
 
 bool Profile::IsSyncAccessible() {
+  if (GetPrefs()->GetBoolean(prefs::kManagedUserNoSignin))
+    return false;

[Andrew T Wilson (Slow), 2013/01/30 10:30:33]

I have a CL in flight that changes how this works
(https://codereview.chromium.org/12077030/) so changing IsSyncAccessible() will
stop sync from starting up but won't prohibit signin.

My suggestion is to add a new API ala "IsSigninAllowed()" and call that API from
every place in the UI that IsSyncAccessible() is currently called, like so:

if (IsSyncAccessible() && IsSigninAllowed()) {
  ...do signin ui stuff...
}

Then when we merge with my CL, we can just change that code to:

if (IsSigninAllowed()) {
   ...do signin ui stuff...
}

+
   browser_sync::SyncPrefs prefs(GetPrefs());
   return ProfileSyncService::IsSyncEnabled() && !prefs.IsManaged();
 }