feat: enforce FileVault during Setup Assistant (#20759)

> Related issue: #16866

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality

ee/server/service/mdm_profiles.go

@@ -33,6 +33,8 @@ var fileVaultProfileTemplate = template.Must(template.New("").Option("missingkey
 			<false/>
 			<key>DeferForceAtUserLoginMaxBypassAttempts</key>
 			<integer>1</integer>
+			<key>ForceEnableInSetupAssistant</key>
+			<true/>
 		</dict>
 		<dict>
 			<key>EncryptCertPayloadUUID</key>