Moved runlock inside begin/rescue/ensure

With the runlock outside of the begin/rescue/ensure block, there are situations in which the
chef-client service can hang indefinitely due to an exception being
thrown and the runlock not being cleaned up.  For instance, if load_node
fails due to the Chef server being down. The following run will wait
forever for the runlock to be released.

This fixes CHEF-4047.