Current thoughts on the multi go routine-safe version

I think the base package is good: you can step timings, not the profile.
This means nothing has to keep track of current - it's up to the user, and
not a large burden. I considered keeping the old API as well, but I think
this is a better way overall.

The main difficulty is the GAE interface. I'm not sure how to associate the
contexts with Timings. One way is the one in this commit: move contexts to
be with Timings. This presents the problem that the _gae.Profile is no
longer a context. Also, there's no obvious way to tie goon calls to the
correct Timing.
Fleshed out a bit more

Send around a Timer interface which both Timing and Profile implement.
Restrict access to internal fields via modifiers. This allows for better
validation and checking. IE: we don't have to ensure the CustomLinks map
is non nil.

Caveat: the gae package now hooks all custom timing calls into the most
recent step. Appstats needs to be refactored to support this use case.
Create a new context in each step