Only have containers editable when they are part of the hst:workspace

To advertise using hst:workspace to contain changes that are made through the channel manager and make sure that the channel manager does not make changes in non-workspace configuration, we need to add support to make containers in non-workspace immutable