Move deploy lock to a darklang canvas

[pbiggar]

Changelog:

Internal
- Move deployment lock to a darklang canvas

The deploy lock uses a storage bucket, which requires cloud permissions to be put almost everywhere during a deploy.

This reimplements the deploy lock as a simple dark DB, in https://darklang.com/a/ops-circleci, and rewrites the deploy lock scripts to use it.

There is a secret in that canvas already. For deploying locally, which we almost never do, we could stop using the deploy lock perhaps, or have a key locally. I'm leaving that decision to a later day, when we have more experience with how the goes.

• Followup: restrict gcp deployment permissions to only the darklang-static-assets bucket

[StachuDotNet]

I'll be able to more fully review this in an ~hour, but:
https://darklang.com/a/ops-circleci#handler=853689901&trace=fe7a4e3f-0eee-8319-4385-bf4ab251ccf5
the recent traces of this all seem to return a 400 with body account_inactive - is that expected?

[pbiggar]

I'll be able to more fully review this in an ~hour, but:
https://darklang.com/a/ops-circleci#handler=853689901&trace=fe7a4e3f-0eee-8319-4385-bf4ab251ccf5
the recent traces of this all seem to return a 400 with body account_inactive - is that expected?

That handler isn't related to this PR - that one does slack messages from builds, which no longer work because we disabled access to Slack as part of rolling creds recently. That should be switched to discord soon.