A user.js file should do the thing. It doesn't exactly lock the variable but rather the browser sets it on each launch, so even if it was overridden by an update, it would be overridden by the file again afterwards.

You should be able to achieve that by creating an appropriate policies.json file.

You can put the setting in user.js file. For example, check arkenfox.

I can't help you with Firefox being a moving target, but this is exactly why i use mullvad browser now. All the settings at my preferred paranoia level out of the box