Return a failure code if initialized and locked

[x1ddos]

This came up in #451:

    // No other message than the attestation and unlock calls shall pass until the device is
    // unlocked or ready to be initialized.
    if bitbox02::memory::is_initialized() && bitbox02::keystore::is_locked() {
        return Vec::new();
    }

Instead of returning an empty slice, OP_STATUS_FAILURE or something else could be returned to make it more consistent?