ds2: introduce an rsync locking mechanism

[ghost]

Sven did the following for backup_dir and publication target:

• when something has built, rsync from build dir to backup_dir
• independently, also rsync from build dir to backup_dir

After much musing about how that backup dir is in actuality not really reflecting any kind of real backup state from me, Eli reworked the way we rsync a bit:

• when something has built, always copy to backup_dir first
• rsync the entire backup_dir to the publication target

Imo that idea is still a good one in general:

• It allows us to properly sync the external-tree as it can just sit in the backup dir
• build-navigation needs wide access to different directories anyway, so it would always need full access to the entire backup_dir/publication target

However, it does occasionally lead to some chaos when multiple docset are building/syncing concurrently. In the end, everything should balance out, but:

• we may occasionally sync temporary files (or rsync may see temporary files but fail when they're suddenly gone)
• we may temporarily unpublish documents that are currently building (as we clean up the backup_dir before copying new documents in there)
• multiple rsync may be running concurrently

[ghost]

We already have repolock.py which is probably pretty much exactly what we need, except we need it for locking the backup_path and not a git clone path.