docs(users): document the Locked and State fields

Add documentation to clarify the distinction between the Locked and State fields on the BasicUser type:

• Locked: temporary lock due to failed login attempts (Devise lockable)
• State: permanent administrative status (active, blocked, banned, etc.)

These fields are independent: an active user can be locked, and a blocked user can be unlocked. This distinction is often misunderstood due to lack of documentation in the GitLab API docs.