Use a distributed lock for DNS details

Let's not do work on every machine that only needs to be done on one.

Also pull out lock-related code from Whitehall mappings into a reusable class.