Sync pods asynchronously in the Kubelet.

This makes two main changes:
- Runs syncPod in a separate Go routine (and enforces only one of those
  runs at a time).
- Uses the pod list to determine if a container should be running or
  should be killed (used to use the output of syncPod).

Since Docker pulls are synchronized by the Docker daemon we still block
on that, but pods can now be removed and prepared for starting without
blocking on long pulls.
For small lock/unlock sections (particularly those without returns in the middle). It is lighter weight to not use defer (there are benchmarks for this). I'm also a huge fan of defer, but it seemed a bit overkill here.

The lost update shouldn't matter as we're going to send it again in the next sync.

@smarterclayton I think that's where we're going and this is a step in that direction.