Add configuration form, permissions to allow override

I think a permission would just work, it is config but you set it as part of your deploy, so a role that have a perm can be assigned/removed from the user as necessary.

I can't think of an issue with the permission.

I also wanted to provide another means of setting the read only lock (globally) and I wondered if using state is also a nice alternative, as that can be changed on the fly through drush or other means.

Here is the solution we use in our project.