cmd/go/internal/modfetch/codehost: add lockfiles for repos
The lockfile guards calls that may change the repo's filesystem contents.
We don't know how robust VCS implementations are to running
simultaneous commands, and this way we don't need to care: only one
'go' command at a time will modify any given repository.
If we can guarantee that particular VCS implementations are robust
enough across all of the VCS tool versions we support, we may be able
to remove some of this locking to improve parallelism.