Add the ability to make an index read-only.

This will let us prevent writes into an index during a migration.
Lock the old index for writes while migrating.

This prevents writes to the old index, which would be lost when we
switch the alias over to the new index.

We will still lose writes at the moment if the migration takes long
enough that the queue worker gives up (about 7 minutes).
Make workers reschedule when the index is locked.

Rather than going through the usual retrying process, which will
eventually give up and fail, rescheduling means we won't lose the
updates. It does leave the possibility of infinite retrying if the
index stays locked, but we should detect this situation some other
way.