Is this an engine thing that should be proposed to ioquake3 staff?
It is a SDL thing. Newer versions of SDL allows the environment SDL_DISABLE_LOCK_KEYS to be set to "1" to allow caps-lock and num-lock to be used as keys. Debian uses a modified version of SDL that always allows Caps-lock.
I guess one could add
setenv("SDL_DISABLE_LOCK_KEYS","1",0 /*allow user provided value*/);
before SDL_Init() in the engine to make this the default behavior.