Fix installation issues due to lock race conditions

- add lock() on the tarball in unpack()
- use lockfile from https://github.com/isaacs/lockfile/pull/1
- use only the LockObjects from lock() to unlock() locks
- check whether we got locks in callbacks

This fixes issues with tar pack() and unpack(), where npm would simultaneously start packing and unpacking a tarball, resulting in a corrupted tar to get unpacked, finally crashing npm when it tried to readJson(). I believe this fix will also fix many of the ELIFECYCLE et al issues, where the workaround was simply to rerun npm install.