Lock feed.public and feed.http-hooks config options

Summary:
Ref T6817. Ref T5726. These both bypass policy checks, and would allow an attacker who gains control of an administrative account to enable public feed, then view feed stories they could not normally see; or enable feed.http-hooks, then read the posted text.

In the longer term I'd like to remove `feed.public` completely (possibly providing API alternatives, if necessary).

Test Plan: Looked at options in web UI and saw them locked.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T6817, T5726

Differential Revision: https://secure.phabricator.com/D11046

src/applications/feed/config/PhabricatorFeedConfigOptions.php

@@ -14,6 +14,7 @@ final class PhabricatorFeedConfigOptions
   public function getOptions() {
     return array(
       $this->newOption('feed.public', 'bool', false)
+        ->setLocked(true)
         ->setBoolOptions(
           array(
             pht('Allow anyone to view the feed'),
@@ -30,6 +31,7 @@ final class PhabricatorFeedConfigOptions
             "NOTE: You must also set `policy.allow-public` to true for this ".
             "setting to work properly.")),
       $this->newOption('feed.http-hooks', 'list<string>', array())
+        ->setLocked(true)
         ->setSummary(pht('POST notifications of feed events.'))
         ->setDescription(
           pht(