provisioners/chef: put global lock around knife exec