Serialize enrollment install with enrolling.lock

Concurrent enroll-url launches could both pass the enrollment
marker check and run overlapping elevated installs, racing on
LoadOrExchangeAPIKey and overwriting agent.key.

Add an exclusive flock on {configDir}/enrolling.lock for the
full install path and re-check IsEnrolled under that lock so
only one install exchanges a token and configures the device.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/deviceagent/config_paths_windows.go

@@ -37,7 +37,7 @@ func DefaultConfigDir() string {
 }
 
 // DefaultEnrollmentRunDir returns the runtime directory for the public
-// enrollment marker on Windows.
+// enrollment marker and enrolling.lock on Windows.
 func DefaultEnrollmentRunDir() string {
 	programData := os.Getenv("ProgramData")
 	if programData == "" {