First, understand that under EFI/UEFI, the computer stores boot loaders on a partition known as an EFI System Partition (ESP). This partition holds a FAT32 filesystem and is identified by a particular partition type code, which parted, GParted, and similar libparted-based tools identify as having the "boot flag" set. Thus, when you removed the "boot flag" from your ESP, you damaged the disk, and setting the "boot flag" on a Linux or Windows exacerbated this problem. These actions are probably why your computer stopped booting anything. You should use GParted to re-set the "boot flag" on the ESP and remove it from all other partitions. Your Boot Repair output shows this set correctly, so my guess is that you've either already done this or your Boot Repair output was taken before you altered your boot flags. (Your post isn't clear on when the Boot Repair output was taken.)
Second, I'm not entirely sure what the "locked ESP" message you referred to means; I've never encountered this myself, and I don't recall hearing of it, either. My guess is that it refers to a partition having a read-only flag set, but I'm not positive of that. If I'm right, this flag can be removed with gdisk (installed from a package of the same name): Type x to get to the experts' menu, then type a to adjust flags. This will show the flags (in an admittedly crude user interface); near the bottom, you'll see:
Attribute value is 1000000000000000. Set fields are:
60 (read-only)
If you don't see that 60 (read-only) line, then hit the Enter key followed by q to quit without saving. If this line is present, though, type 60 to toggle the flag off, then hit Enter, then hit w to save your changes.
Disabling Secure Boot could be helpful, or even necessary; but disabling EFI-mode booting or enabling legacy-mode booting will be unhelpful.
You might try downloading the CD-R or USB flash drive image of rEFInd and burning/writing it to a suitable medium. You might then be able to boot that medium to get a working boot manager, which should enable you to boot Linux. If that works, then installing the rEFInd Debian package from within your booted system may get rEFInd working from your hard disk, without help from an external medium. If rEFInd works from the external medium but not from the hard disk installation, then you've got a buggy firmware. Numerous specific bugs can cause this general symptom. The most general solution is to rename your boot loaders so that rEFInd launches instead of the Windows boot loader. This is described in the rEFInd documentation, and Ubuntu's Boot Repair does something similar with GRUB. Some computer manufacturers make things even harder, though, by creating their own boot partitions -- manufacturer-specific variants on the ESP. Your Boot Repair output makes it look like your computer may have such a partition (/dev/sda2), but Boot Repair hasn't found any boot loader files on that partition. Thus, it's not clear what, if any, extra steps would have to be taken on your system because of this. Finding all the files with names that end in .efi or .EFI on that partition might provide some clues about that.
