Ensure only one instance of check-mirrors.rb runs concurrently

Now that we're running check-mirrors.rb 4 times more often,
there's greater chances that 2 of them end up running at the same time.
Let's avoid having to reason about how check-mirrors.rb manages
shared resources such as its failures.json state file.

refs: tails/tails#17755

manifests/check_mirrors/cronjob.pp

@@ -10,7 +10,7 @@ define tails::check_mirrors::cronjob (
   $args_str = join($args, ' ')
 
   cron { "tails_check_mirrors ${title}":
-    command     => "sleep \$(( \$( </dev/urandom od -N2 -t u2 -A none ) >> 5 )) && \"${tails::check_mirrors::repo_checkout}/check-mirrors.rb\" ${args_str}", # lint:ignore:140chars -- command
+    command     => "sleep \$(( \$( </dev/urandom od -N2 -t u2 -A none ) >> 5 )) && flock --nonblock check-mirrors.lock \"${tails::check_mirrors::repo_checkout}/check-mirrors.rb\" ${args_str}", # lint:ignore:140chars -- command
     user        => $tails::check_mirrors::user,
     hour        => $hour,
     minute      => $minute,