Lock uri.allowed-protocols in Config

Summary: This allows administrative overreach. Administrators can enable javascript: and then XSS things if this isn't locked.

Test Plan: Viewed value on web UI, verified it was locked.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D6975