correct parallel droplet downloading

Previously if multiple droplet downloads started at once, the
following failure modes could happen:

1. Other downloads would see the file exists and try to unpack it
immediately.

2. If the download failed, the droplet file would remain on the
filesystem.

The fix is to reinstate the download synchronization, and to only create
the droplet file if the download succeeds.

Also added an optimization; if the droplet is already downloaded and has
the proper SHA1, the download will be skipped.

[#58586470]
create app package file only if downloaded

Previously a failed download would leave an empty file in place of the
tarball.

[#58586470]