Locking a user through the API should also deactivate their services

In #1159 (closed) a feature was implemented which meant that 'locking' a client would also de-activate all their services (website, ftp user, mail, ...). Locking a client through the API does not do this. Perhaps this is expected behaviour, since the 'locked' and 'canceled' attributes are not documented in /remoting_client/API-docs/client_update.html. But imho the API should mimic the web interface behaviour here, so that means:

• document parameters 'locked' and 'canceled' in /remoting_client/API-docs/client_update.html
• when locking a client, also deactivate all their stuff
• when unlocking a client, also activate all their stuff

@tbrehm if you agree, I could send a PR