Follow up work from  issue 719907 :
- Add a policy for admins to disable the kiosk cert manager UI.
  There is a "prompt_for_network_when_offline" policy. However the
  policy controls whether to show the network config UI, which could
  be useful without the cert manager itself. The new policy should
  control only the "Manage certificates" button on the network config
  UI;

- Clean up existing kiosk app profiles to keep only the client certs
  for EAP-TLS;