locked mode: reject all deployment attempts

Respond to all deployment attempts of any kind with a 403 Forbidden
when the STRONG_PM_LOCKED environment variable is set to any non-blank
value.

This feature is primarily for strongloop/strong-arc#656, so the feature
is intentionally undocumented until we decide if/how we want to surface
it in a maintainable way.

/cc @chandadharap @altsang @kraman