xbps_transaction_commit: return error if downloading binpkg/signature fails.
NEWS: mention previous bugfix.
Fix concurrency issues in pkgdb: only allow 1 write transaction at the same time.

This implementation relies on a POSIX named semaphore, which is also
required by xbps-rindex(8).