Add CF_CLIENT_LOCKED to cf mask, use it when taking
client_lock.

This change adds the cf to _path_walk, but most callers are just
marked for update in later commits.

Signed-off-by: Matt Benjamin <matt@linuxbox.com>