This allows the default mlock to be configured without the requirement
for a module like contrib/mlocktweaker. Notably, unlike that module,
this option overrides the default mlock of +nt; in particular, this
makes it possible to remove these default entires entirely instead of
having to overwrite them with a -n or -t entry.

As with contrib/mlocktweaker, currently only simple modes (without a
parameter) are supported. Additionally, the behaviour of locking -lk
unless a limit/key is already set is preserved and cannot currently be
configured (not even by explicitly specifying these in the default mlock
as they both take a parameter).

Fixes #602, with the above caveats.