An APD can be locked and unlocked

[beparticular]

The MVP for what has previously been called "lock and submit" would be created by this work. We've been calling this "Lock APD for data integrity" as the start to a full multi-user editing option TBD later in the roadmap.

Add a locked field to the APD. Update the getAllAPDsByState to also return the locked status.

Add an entry in the apd_event table, using createEventForAPD, for each lock and unlock event.

Designs: this flow shows how the UI will work when there are two or more people in the system, and their experience of recognizing that an APD is locked by another user. Deeper details of which should also be reflect in the test cases below. https://www.figma.com/file/6eVvo7JjvXiovGTR4BoVgK/CMS-eAPD-2022?node-id=8800%3A27220 (From original design tickets #3918 and #4016, but all the written info needed should be here in this new ticket)

Test Cases:

Given	When	Then
an unlocked APD	a user enters that APD	The locked field should be set to true. The updatedAt field should be updated to now. The updatedBy field should be set to the current user
a locked APD	the user exits the APD to go to any other page (Dashboard, Admin Panel, another APD)	The locked field should be set to false. The updatedAt field should be set to now.
a locked APD	the user's session times out	The locked field should be set to false. The updatedAt field should be set to now.
an unlocked APD	two users access that APD same time	the first user to hit the backend gets access, the second user gets the modal

This task is done when...

• [ ] create a migration to update the APD model to have a locked field
• [ ] getAllAPDsByState has been updated to also return the locked state
• [ ] getAPDByID returns an error if the APD is locked, otherwise it updates the locked field to be true
• [ ] added an endpoint to update the locked status // TODO
• [ ] leaving the APD updates the locked status // TODO
• [ ] user session timeout updates the APD status to locked