Cursor locking (using Cursor.lockState) and Fullscreen mode (using Screen.fullScreen) are both supported in Unity WebGL, implemented using the respective HTML5 APIs (Element.requestPointerLock and Element.requestFullscreen). These are supported in Firefox and Chrome, Safari cannot currently use fullscreen and cursor locking.
Due to security concerns, browsers will only allow locking the cursor or going into fullscreen mode in direct response to a user-initiated event (like a mouse click or key press). Unfortunately, due to the way Unity handles events (it does not have separate event and rendering loops), Unity defers event handling to a point where the browser will no longer see a fullscreen or cursor lock request issued from Unity scripting to be a direct response to the event which triggered it. Unity will then trigger the request on the next user-initiated event.
In order to make this work with acceptable results, we recommend that you trigger fullscreen or cursor locking requests on mouse/key down events (as opposed to mouse/key up events as you would usually use). That way, when the request is deferred to the next user-initiated event, it will get triggered when the user releases the mouse or key.
If you use Unity’s UI.Button component, you can achieve the desired behaviour by creating a subclass of Button, which overrides the OnPointerDown method.
Note that browsers may show a notification message and/or ask the user for permission before entering fullscreen mode or locking the cursor.