Use a weak reference in the image removal callback

This is required for "-rl" invokations of pqiv
Use a mutex for bostree access

The image loader thread requires this. Maybe I'll move the thread safety
into bostree one day.