feat(cime): Support lock_on_restart attribute and locked file validation

## Describe the problem your experiencing

We don't have a mechanism to mark variables that can be set at runtime but only at the start (as opposed to build time, or any run time including restarts). See [ESCOMP/CTSM#4122](https://github.com/ESCOMP/CTSM/issues/4122) for an example.

## Describe the solution you'd like

Add support for a `lock_on_restart="true"` attribute on XML configuration entries to prevent users from modifying restart-sensitive variables mid-simulation during continuation runs.

## Describe alternative solutions

An alternative option is to continue to be overly conservative (env_build) or overly lax (env_run) in classifying such variables, and rely solely on documentation or manual checks to bridge the gaps, but this risks user error and non-reproducible continuation runs.

## Additional context

The main blocker for this new mechanism is conducting a comprehensive audit across CIME and component models to identify all candidate restart-sensitive variables, preventing false negatives that could give a false sense of confidence. For full context, technical details, and audit proposal discussions, please refer to PR [#5030](https://github.com/ESMCI/cime/pull/5030) which creates such a mechanism, and https://github.com/ESCOMP/CMEPS/pull/692 which uses it.

Start with PR #5030, which the issue identifies as creating the lock_on_restart mechanism, then review the XML configuration entries and the audit proposal referenced there. Done means the attribute is supported and candidate restart-sensitive variables across CIME and component models have been identified without false negatives.

Written by the indexing model from the issue text.