Use lockf() instead of flock() when locking repository/cache

This is a reworked version of Petros Moisiadis' original pull request
since some extra effort is needed to support access to read-only
repositories.