Add backend support for locked labels on merged MRs

What does this MR do and why?

Add backend support for locked labels on merged MRs. If a label is marked lock_on_merge, then it cannot be removed from a merged MR. Nor can the label itself be removed. Useful for strict auditing.

UI support will be added in an upcoming MR. Support for scoped labels will be added in an upcoming MR.

How to set up and validate locally

Although the actually setting a label as locked is not possible via the UI, you can test it out in the UI.

0. Enable the feature flag: Feature.enable(:enforce_locked_labels_on_merge)
1. Find a project, and a label. Hover over the "Edit" link to get the label's id
2. Update the lock_on_merge column of the labels table for the id, to true. Such as Label.find(109).update!(lock_on_merge: true)
3. In the UI, add the newly locked label to an open MR. You should be able to delete it by clicking on its (x) next to its name, or using the /unlabel quick command.
4. Now pick an already merged MR (or merge the open one).
5. You should be able to add the label, but will not be able to remove it.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #408676