Allow user and admin lock of an instance

The existing instance lock capability is currently restricted
to being an admin-only action in the default policy. This
introduces additional functionality that allows the lock to be
used by users (to prevent accidental changes to an instance for
example), but also allows the lock to taken by an administrator
with appropriate privileges such that it overrides any lock held
by the user (for example to block actions on a rouge instance).

When unlocking an instance, an additional check is made to see if
the lock is held by user. If it isn't, an additional check is
made against the unlock_override policy.

Additionally added the current instance lock status to the
v3 extended status extension.

Blueprint mandatory-vm-lock
Flags: DocImpact

Change-Id: I5040276c2d9fd42a71c9d8d4529331992abd7538
Merge "Allow user and admin lock of an instance"