sysroot: Add an API to lock

If a system administrator happens to type `ostree admin upgrade`
multiple times, currently that will lead to a potentially corrupted
system.

I originally attempted to do locking *internally* in `libostree`, but
that didn't work out because currently a number of the commands
perform multi-step operations that all need to be serialized.  All of
the current code in `ostree admin deploy` is an example.

Therefore, allow callers to perform locking, as most of the higher
level logic is presently implemented there.

At some point, we can revisit having internal locking, but it will be
difficult.  A more likely approach would be similar to Java's approach
with concurrency on iterators - a "fail fast" method.

doc/ostree-sections.txt

@@ -365,6 +365,8 @@ ostree_sysroot_new
 ostree_sysroot_new_default
 ostree_sysroot_get_path
 ostree_sysroot_load
+ostree_sysroot_lock
+ostree_sysroot_unlock
 ostree_sysroot_get_fd
 ostree_sysroot_ensure_initialized
 ostree_sysroot_get_bootversion