Move the "Can Lock Projects" check from requireCapabilities() to transaction validation

Summary: Depends on D19584. Ref T13164. This check is an extra check: you need EDIT and this capability. Thus, we can do it in validation without issues.

Test Plan:

• This code isn't reachable today: all methods of applying this transaction do a separate check for "Can Lock" upfront.
• Commented out the "Can Lock" check in the LockController, tried to lock as a user without permission. Was rejected with a policy exception.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13164

Differential Revision: https://secure.phabricator.com/D19585