Avoid snowballing on initial cloning

If there are more than twice as many repos locked as there are
pull_threads configured, then refuse to clone any new repos. Otherwise,
we get into a snowball condition where every next run of grok-pull tries
to clone more repos, until the upstream starts denying us because we
exhaust per-ip rules.