RFC: role locks (BNC#861527)

This is basically #1028, but missing a lock in allocate! (https://github.com/crowbar/barclamp-crowbar/pull/1028/files#diff-496ddf4ffc5694a5fcdddbff8206dc8dL384).

The problem I'm not sure how to solve is that we need to both sync the node and role attributes and also sync the role with whatever is in the chef DB, and if the node <> role sync should not be locked as well.