Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)" (#1103)

This reverts commit 996ac343ee.

The lock is still needed to guard against the following scenario.

d92a892ece/act/runner/run_context.go (L225-L236)

- two or more jobs start
- one of them creates the act template (`lxc_build_template $(lxc_template_release) $name`) - lxc-helpers now has transactions and they won't race against each other
- once it is built all jobs will then try to install node in the container that was just built and race against each other

with a global lock only the first one will build and populate the act template. The other will then do nothing because it already exists.

The bug can trivially be reproduced with:

```yaml
on:
  pull_request:

jobs:
  test1:
    runs-on: lxc
    steps:
      - run: echo OK1
  test2:
    runs-on: lxc
    steps:
      - run: echo OK2
  test3:
    runs-on: lxc
    steps:
      - run: echo OK3
```

<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1103): <!--number 1103 --><!--line 0 --><!--description UmV2ZXJ0ICJjaG9yZShjbGVhbnVwKTogbHhjLWhlbHBlcnMgZG9lcyBub3QgbmVlZCBhIGdsb2JhbCBsb2NrICgjMTA0Nyki-->Revert "chore(cleanup): lxc-helpers does not need a global lock (#1047)"<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/1103
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: limiting-factor <limiting-factor@noreply.code.forgejo.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>

act/runner/run_context.go

@@ -193,6 +193,8 @@ var lxcHelpers string
 
 var startTemplate = template.Must(template.New("start").Parse(`#!/bin/bash -e
 
+exec 5<>/tmp/forgejo-runner-lxc.lock ; flock --timeout 21600 5
+
 LXC_CONTAINER_CONFIG="{{.Config}}"
 LXC_CONTAINER_RELEASE="{{.Release}}"