Unlocking only by posession of lock

- remove public access to unlock()
- return lock object in lock() that must be used to unlock, except by force when stale
- add tests

This fixes an issue in npm where tons of packages were trying to install a particular dependency. It prevents anyone not in posession of an active lock to remove the lock file, which was causing tar's pack() and unpack() to run in parallel, causing a corrupted tarball to be unpacked.