GetRestrictions called the daemon GetConfig with an empty
GetConfigRequest, which the daemon has rejected since multi-profile
support landed ("active profile name is empty") because it reads the
profile name from the request. Resolve the active profile via
GetActiveProfile first and pass its name/username, mirroring the
working Settings.GetConfig path. GetActiveProfile self-heals to the
default profile, so a valid name is always supplied; the
profile-switch-disabled MDM flag is orthogonal and unaffected.
c68bb8f99f