Add device disabling to OOBE flow

components/policy/proto/device_management_backend.proto

Index: components/policy/proto/device_management_backend.proto
diff --git a/components/policy/proto/device_management_backend.proto b/components/policy/proto/device_management_backend.proto
index 0425d1087278d148c52e39128f30164d44626550..e3b69391b23cb8c3f0763ddae0f6e085323e82a7 100644
--- a/components/policy/proto/device_management_backend.proto
+++ b/components/policy/proto/device_management_backend.proto
@@ -599,6 +599,11 @@ message DeviceStateKeyUpdateRequest {
   repeated bytes server_backed_state_key = 1;
 }
 
+message DisabledState {
+  // A message to the finder/thief that should be shown on the screen.
+  optional string message = 1;
+}
+
 // Server to client message carrying the device state response. Because the
 // request is not authenticated, the only protection against state extraction
 // from server is the unpredictability of the server-backed state ID. Thus, the
@@ -620,6 +625,9 @@ message DeviceStateRetrievalResponse {
 
   // Primary domain the device is associated with.
   optional string management_domain = 2;
+
+  // The device is disabled and no logins are possible when this is set.
+  optional DisabledState disabled_state = 3;
 }
 
 // Sent by the client to the server to pair the Host device with the Controller