Lock cracklib against concurrent access

Not only is it not re-entrant, but the ancient version running on
production literally exits on mutex