Fix data race in kubelet fake_docker_client

Clayton had a good argument against omitting the `lock` name:
> inlining the lock makes Lock and Unlock public, it's considered bad form to do that (unless someone needs to use that lock external to the client).