Add an endpoint to the export api to allow the document import process
to flag a document that's being imported as "locked" so that users are
not permitted to make any changes to it.

Ensures that only users with export data permissions can access this
endpoint.

A 204 No Content is returned if the lock request is successful.
[Rails 5](rails/rails#19377) does this by
default by automatically adding `:no_content` to the header if it can't
find a template to respond with.

Add an endpoint to the export api to allow the document import process
to "unlock" a document that's being imported if the import has failed
for any reason.

Ensure that only users with export data permissions can access this
endpoint.

A 204 No Content is returned if the unlock request is successful.
[Rails 5](rails/rails#19377) does this by
default by automatically adding `:no_content` to the header if it can't
find a template to respond with.

Authenticity token are generated as a hidden field in Whitehall forms. As it is not intended for these
POST routes to be called from a form within in the application, these check should be skipped.