R1:db1cd6586609

Allow setup checks to perform writes

Summary:
Fixes T8198. Currently, if the `policy.locked` configuration setting includes a value which is a user PHID, we may perform a cache fill during setup as a side effect of validating it.

Right now, there is no WriteGuard active during setup, because we don't have a Request object yet so we can't actually perform CSRF validation.

Two possible approaches are:

# Prevent the write from occuring.
# Change the code to allow the write.

In the past, I think we've…