Allow setting FSCRYPT_CONSISTENT_OUTPUT=1 in the environment to cause
policies and protectors to sorted by last modification time.  The CLI
tests need this to make the output of 'fscrypt' ordered in a consistent
way with regard to the operations performed.

Allow overriding the mountpoint where login protectors are stored by
setting the FSCRYPT_ROOT_MNT environmental variable.  The CLI tests need
this to avoid touching the real "/".

Allow overriding the location of fscrypt.conf by setting the
FSCRYPT_CONF environmental variable.  The CLI tests need this to avoid
touching the real /etc/fscrypt.conf.

There's no need to include the build time, author, and copyright info
in the output of "fscrypt --version". This information is:

  - Overly complex (the current string is hard to parse)
  - Inaccurate (there are other authors than just me)
  - Unnecessary (the Apache 2 license is for Source Code)
  - Makes reproducible builds impossible

The default version string is just fine.

Signed-off-by: Joe Richey <joerichey@google.com>

Add support for 'fscrypt lock'.  This command "locks" a directory,
undoing 'fscrypt unlock'.

When the filesystem keyring is used, 'fscrypt lock' also detects when a
directory wasn't fully locked due to some files still being in-use.  It
can then be run again later to try to finish locking the files.

These were found by a combination of manual review and a custom script
that checks for common errors.

Also removed an outdated sentence from the comment for setupBefore().

Our current build tags set off the linter. We will later add in more
comprehensive build tags that will be properly formatted.