- A small refactor, moved SSH root lock and sudoers handling to seperate

tasks files included only when enabled.
- Change lock_root to lock_root_ssh to be more explicit about what it
does (previous behavior was also local lock. The behavior changed but
the name remained).
- More assertions.
- Updated documentation.