In the screen lock tab we add a "Forbid new USB devices" entry with a
switch to enable or disable said protection.
The actual USB protection is handled by gnome-settings-daemon and
USBGuard.
We use the "Available" property of gnome-settings-daemon to check
if we are able to offer the USB protection (i.e. USBGuard is
installed with the minimum required version ecc..).
If the host doesn't met the requirements we hide the USB
protetion row entirely.
Given the fact that the always on protection benefits are very slim we
decided to give just an on/off switch that by default controls the
"with lock screen" protection level.
