You can't refuse to be scanned by ICE's facial recognition app, DHS document say