Add locking to package uploads