concurrent pip installs can result in corrupted packages

[rbtcollins]

From #2745:

• we don't take a lock out on the environment we're installing into,which means that the nested install in 2745 does the wrong thing, but also
• any concurrent install (e.g. two terminals) can trigger the same behaviour

[qwcode]

yes, we should be locking.

[xavfernandez]

Duplicate of #2361

[rbtcollins]

Its duplicatish, but this is more general: it applies not just to virtualenvs as the other bug does, but to any target environment, including directories, alternate roots, and so on. Happy if you want to dupe them but please be sure to reword the other as being broader scope.