Serialize enrollment install with enrolling.lock

Concurrent enroll-url launches could both pass the enrollment
marker check and run overlapping elevated installs, racing on
LoadOrExchangeAPIKey and overwriting agent.key.

Add an exclusive flock on {configDir}/enrolling.lock for the
full install path and re-check IsEnrolled under that lock so
only one install exchanges a token and configures the device.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/deviceagent/enrollment_state.go

@@ -40,8 +40,9 @@ const (
 )
 
 // EnrollmentRunDir returns the runtime directory for the public enrollment
-// marker. Production installs use DefaultEnrollmentRunDir(); custom --dir
-// values get an isolated sibling run tree for dev and tests.
+// marker and the short-lived enrolling.lock. Production installs use
+// DefaultEnrollmentRunDir(); custom --dir values get an isolated sibling
+// run tree for dev and tests.
 func EnrollmentRunDir(configDir string) string {
 	if configDir == "" {
 		configDir = DefaultConfigDir()