[Admin] Require admins to provide reasons for locking users

Right now, we don't have any context within HCB about why a user was locked from signing into HCB. While an external Airtable base exists, it's possible to forget to add an entry when locking a user. We should require that admins add a note when they want to lock a user.

For simplicity, this should be an admin-only comment on the user.

Start by tracing the admin flow for locking a user's HCB sign-in and the existing user-comment behavior. Done means an admin cannot lock a user without providing a note, and that note is retained as an admin-only comment in HCB.

Written by the indexing model from the issue text.