fix(security): enforce template locks on native alarm source overrides at flatten and management-command level

Add IsLocked to ResolvedNativeAlarmSource; FlatteningService skips overrides on a
locked source (mirrors attribute/alarm lock rules); ManagementActor SetInstanceNativeAlarmSourceOverride
flattens the instance and rejects an override on a locked source (and rejects a
canonical name that does not resolve, preventing dangling overrides).

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.TemplateEngine/Flattening/FlatteningService.cs

@@ -718,7 +718,8 @@ public class FlatteningService
                     ConnectionName = binding.ConnectionName,
                     SourceReference = binding.SourceReference,
                     ConditionFilter = binding.ConditionFilter,
-                    Source = source
+                    Source = source,
+                    IsLocked = binding.IsLocked || lockedNames.Contains(binding.Name)
                 };
 
                 if (binding.IsLocked)
@@ -811,6 +812,9 @@ public class FlatteningService
             if (!sources.TryGetValue(ovr.SourceCanonicalName, out var existing))
                 continue; // Cannot add new bindings via overrides.
 
+            if (existing.IsLocked)
+                continue; // Locked at the template level — instance override is ignored.
+
             sources[ovr.SourceCanonicalName] = existing with
             {
                 ConnectionName = ovr.ConnectionNameOverride ?? existing.ConnectionName,