Prevent deleting actuals in a locked timesheet period

DELETE /actuals/{actualId} now returns 400 Bad Request with the message "Project actuals are locked" when the actual is dated on or before the project's timesheet lock date. Before this fix, locked actuals could be deleted through the API.