Add environment lock/unlock/locked handling

This PR adds support for `deploy:lock` and `deploy:unlock` tasks.

These tasks are intercepted and handled separate from any provider.

When an attempt to deploy to a locked environment is made, we'll send up an error deployment status with a description including who locked the environment.

Addresses #55