Add bin/policy unlock

Summary: Ref T603. We might need a fine-grained CLI tool later on, but here's a bat we can bludgeon things with.

Test Plan:

• Ran bin/policy unlock D12 (adjusted policies).
• Ran bin/policy unlock rPca85c457ebcb (got "not mutable" stuff).

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7189