Add locks and proper file management facades

[Gankra]

Fixes #115

• New FileLock type for managing a lockfile, used for both the cache and supply-chain (separate locks)
• New Store type that wraps config.toml/audits.toml/imports.lock
  • Manages acquiring the FileLock
  • Manages loading the files and validating their consistency (stubbed, not implemented)
  • Manages fetching imports and checking for criteria changes (checking is stubbed)
  • Manages storing the files back (only done when manually requested by a command to avoid changes on-error)
• All commands that touch supply-chain now unconditionally acquire it and commit it on success
  • This means every (non-freestanding, non-debug) command will try to validate+fetch-imports+fmt

Drive-by changes:

• notes on audits were moved back up due to limitations in toml-rs around nested tables. More aggressively trying to fmt+commit exposed this issue
• --readonly-lockless was added as a hack to disable the supply-chain lock for concurrent tests

[Gankra]

Oh whoops I missed some cases, one sec

[Gankra]

There we go