avbctl: Require --force option if in LOCKED mode.

Bail and print a nice little warning if the user tries to rewrite
vbmeta if the device is locked. This is to help protect the user from
potentially bricking his device.

 device:/ # avbctl disable-verity
 Manipulating vbmeta on a LOCKED device will likely cause the
 device to fail booting with little chance of recovery.

 If you really want to do this, use the --force option.

 ONLY DO THIS IF YOU KNOW WHAT YOU ARE DOING.

 77|device:/ # avbctl --force disable-verity
 Successfully disabled verity on slot with suffix _a. Reboot the device for changes to take effect.
 device:/ #

Bug: 64482211
Test: Manually tested in both LOCKED and UNLOCKED mode.
Change-Id: Ica7b7df947ccb5fe515a3dae8c81eedfd594ca38