Add a lock to the update_heroes function.

Greatly reduces the chance of the server getting hit hard if it receives multiple requests after the hero data has expired but before any of those requests have completed.  I.e. the risk was we could get lots Hero.update_heroes_from_webapi() running concurrently.