Fix on demand so that it's not enabled too soon

[diegoreymendez]

Task/Issue URL: https://app.asana.com/0/1203137811378537/1206543593200557/f

Description:

Enables on-demand only after the VPN has connected.

Testing

1. Check out BSK 109.0.0
2. Add it locally to this branch
3. We want to fake a connection issue that makes the connection take longer to establish, and eventually fails. To do so, replace these lines with the following code:

Task {
    try? await Task.sleep(nanoseconds: 3 * NSEC_PER_SEC)
    completionHandler(NSError(domain: "asd", code: 1))
}

5. Run the app and try to connect the VPN.
6. Make sure it fails after ~3 seconds, and that on-demand isn't turned ON for the connection.

If you want to see the issue that was resolved by these changes, add-back this line that was removed and repeat this test.

---

Internal references:

Pull Request Review Checklist
Software Engineering Expectations
Technical Design Template
Pull Request Documentation