faillock: Hide unlocked users when showing locked users

[BugBaron]

The pam_tally[2] program would only show users who had failed login
attempts. The equivalent faillock program also shows users who have
no failed login attempts.

Added a new option to the faillock program which will show users without
failed login attempts. By default this option is disabled, so the
command will not show those users.

[ldv-alt]

Since the word unlocked implies that something was locked but is no longer locked,
I'm not sure it is the right word to describe users with zero number of tally records.

[BugBaron]

Would users without failed logins be fine instead of unlocked users? Its a bit long, but its more correct.

[ldv-alt]

A bit longer commit message is fine if it's more correct, but
there is the same issue with the name of new option --show-unlocked.

[BugBaron]

Maybe --show-all-users would work, since the default functionality can be explained in the help message. Im struggling to come up with anything more succinct to use for the option.