Add lock around base box upload

I'm not entirely happy with this, because we only really need a lock
when multiple VMs are using the same base box. If they are using
different boxes, we could safely upload in parallel. I did not see an
obvious way to implement that, so this will work. Parallel uploads are
likely not a performance improvement, anyway.