lock_access! better failure message

Hi,

When calling `lock_access!` on a resource, its `locked_at` attribute is set to now, but `failed_attempts` is unmodified.
On the other hand the `unauthenticated_message` methods checks for the value of `failed_attempts`, but not `locked_at`.

As a result, a resource programmatically locked with `lock_access!` will display on the log-in page the flash message `devise.failure.inactive`, instead of `devise.failure.locked`.
So the user that was locked will see the message "Invalid email or password." on the log-in page, which may be confusing.

This PR fix this.

---

Note that there is one assertion failing which is not related to my PR:

> ConfirmableTest#test_should_not_be_active_when_confirm_in_is_zero [/devise/test/models/confirmable_test.rb:223]:
> Failed assertion, no message given.