Allow only metrics and status pmctls when locked

When in locked mode, only allow status and profiling related pmctl
commands. All others respond with an "unsupported" error message.