If there is only 1 AP candidate, and it has been added to denylist by F/W,
it is not allowed to connect, it's bad user experience to end users.
To fix it, if there is only 1 AP candidate, and it has been added to
denylist by F/W, but deny reason is neither critical nor certificate
required, such as REASON_STA_KICKOUT, need allow user to connect it if no
other candidates.
Change-Id: I2ae66ceba943dcfbc927568684218b7120c1e490
CRs-Fixed: 3785252