The flash control block is located in the first block of flash, the block that begins at zero.
If this block is errased (becomes all ones), and the device reset, it will lock.
This is not how security is normally set, but how some users fall into it unexpectedly.
Normally, when security is desired, the flash control block is written to such that the flash is secured at the next reset, using the normal flash writing methods illustrated by the sample programs.
There is no "JTAG" specific way to do this, other than writing to the flash. This can be accomplished with JTAG, or with the internal processor core.
There is no option on the debug (nor run) configurations to lock the flash after loading.
This can be built into the program image, or modified later to lock the flash only after the program runs.