Depends on D19584. Ref T13164. This check is an extra check: you need EDIT and this capability. Thus, we can do it in validation without issues.

• This code isn't reachable today: all methods of applying this transaction do a separate check for "Can Lock" upfront.
• Commented out the "Can Lock" check in the LockController, tried to lock as a user without permission. Was rejected with a policy exception.