add support for "git-crypt lock"

This does the reverse of what git-crypt unlock does:
    - unconfigures the git filters
    - forcibly checks out HEAD version

Result is that you can now decrypt and then revert back to encrypted
form of files and vice versa.