Disallow no-lock and file-input options in cf-agent when called via cfruncommand

This hardens the already existing limitation, which is enforced in
cf-runagent and cf-serverd, but has holes. Ie. --no-loc is accepted by
cf-runagent and cf-serverd, and interpreted by cf-agent as --no-lock
as is standard for unix command line tools.
dry-runs imply no-lock so will be blocked implicitly through the check for the no-lock option