add support for "git-crypt lock"

This does the reverse of what git-crypt unlock does:
    - unconfigures the git filters
    - forcibly checks out HEAD version

Usage:
    git crypt lock                  locks repo using the "default" key

    git crypt lock -k NAME          locks the repo, using unlocked key named NAME
    git crypt lock --key-name=NAME

    git crypt lock -a               locks the repo, removing ALL unlocked keys
    git crypt lock --all

Result is that you can now decrypt and then revert back to encrypted
form of files and vice versa.