Replace per-token locking

Currently the authenticator provides a feature to lock specific tokens with biometrics. While having extra authentication makes sense, the implementation doesn't.

A better approach would be providing a global app lock. That could be based on a PIN with support for biometrics.