Lock updates

We don't actually lock updates yet (when mashing them), but when we do, we need to ensure that maintainers can't edit some parts of a locked update.

The two things we prevent editing right now are:
* adding or removing builds
* setting the update request