Allow configuration options to be locked

Summary: Some config shouldn't reasonably be edited from the web interface because it immediately torpedoes the install if you make a mistake. Block edits to "locked" config.

Test Plan: Tried to edit locked config, got denied. Viewed locked config on edit and list screens.

Reviewers: codeblock, btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T2255

Differential Revision: https://secure.phabricator.com/D4320