Changed order of git servers

Stash asks for a username and password if a repository
doesn't exist.  To avoid this, move I moved the
search of the stash server to the very end.  This
effectively defaults packages to cgit and fails over to
stash.  This is safe as long as the packages don't
exist in two places.
bin/flock-fd: cross-platform equivalent of flock, written in Python
use flock-fd instead of flock, so locking works on OS X