fscrypto: lock inode while setting encryption policy