Allow admins to lock users from TL3 (and TL4) promotion/demotion

Admins can currently manually promote to TL4, but promotions to TL3 will not stick (they get undone in <4 hours, as there isn't even a grace period triggered). Additionally, sometimes you may want a demotion to TL2 as a punishment.

This change adds a `trust_level_locked` column to users, default false, not null, that disables both promotion and demotion for the user.