Use Locked Prefs
https://bugzilla.mozilla.org/show_bug.cgi?id=440908 adds support for locked prefs, which are set during build and cannot be changed.
If that doesn't wind up in 60, I think it should be backported, and taken advantage of.
We can lock at least the proxy settings. We could consider locking FPI and Fingerprinting settings, but I'm not sure those would be appropriate to lock.