Fix race condition in team creation with user rights

Ensure we have a lock on the user before attempting to create a team in the REST API in order to ensure that the capabilities on the user does not change during the team creation process.

We do not take this lock in oo-admin-ctl-team scripts because global teams are created without an owner, therefore keeping the lock at the controller tier seemed best.

See bug 116128 for more details.