Prevent Firefox from attempting to install the XPI

By using HttpResponse() and "Content-Disposition: attachment", this
wouldn’t work with the redirect() call that was used before, but I’m not
sure the redirection is really needed after 1cf39da.
Controlling extension actions with waffle

Added an is_active() method that checks if the extension action specifies
a _waffle_flag property and returns if it is active or not.
Use lock file to prevent concurrent build_xpi calls

Attempting to run build_xpi concurrently can fail with non-obvious
errors, so it is petter to limit it to one build at time.
Separate building and downloading langack actions

So that we can allow everyone to download the packs, but only few to
build them.
Create extension’s flag if it does not exist

Defaults to disabling the flag for all, even superusers.