Reduce likelihood of improper tag build which does not publish artifacts

[zjs]

As of #7753, we no longer include branch values of refs/tags/*.

Because of this, tags pushed via the git CLI will have the incorrect build metadata, causing important steps to be skipped (like bundling and publishing artifacts). In this case the build will appear to succeed, but a tag build of vmware/vic-product won't consume the new engine build (since the artifacts weren't published).

Example drone build info for a pushed tag

Number: 19548
Status: success
Event: tag
Commit: b3a619231503620476d5553e59f70287972f1905
Branch: refs/tags/v1.4.1-rc2
Ref: refs/tags/v1.4.1-rc2
Message: Workaround for concurrent exec issues (#8098) (#8101)

There are outstanding issues to address with concurrent exec. This work is
palliative rather than an actual fix.

Removes checking for "started" in the status string - we reliably see this
field not propagating to the property collector despite being logged as
set in the tether. This _only_ applies to execs at this time as that is
the only path calling task.State (via InspectTask).

Adds locking around dispatch of execs, with a timeout, to serialize that
initial dispatch path against a single container. If the timeout expires
it reverts to current behaviour and relies on concurrent modification and
retry.

(cherry picked from commit c99f0216c82ca9b1ef5065a2d109800e21cc6ef8)
Author: zjs

Example drone build info for a tag created via GitHub

Number: 19554
Status: running
Event: tag
Commit: b3a619231503620476d5553e59f70287972f1905
Branch: releases/1.4.1
Ref: refs/tags/v1.4.1-rc2
Message: Workaround for concurrent exec issues (#8098) (#8101)

There are outstanding issues to address with concurrent exec. This work is
palliative rather than an actual fix.

Removes checking for "started" in the status string - we reliably see this
field not propagating to the property collector despite being logged as
set in the tether. This _only_ applies to execs at this time as that is
the only path calling task.State (via InspectTask).

Adds locking around dispatch of execs, with a timeout, to serialize that
initial dispatch path against a single container. If the timeout expires
it reverts to current behaviour and relies on concurrent modification and
retry.

(cherry picked from commit c99f0216c82ca9b1ef5065a2d109800e21cc6ef8)
Author: zjs

At the very least we should fail fast with a clear error message if the tag has been created the wrong way. (Better yet would be to support both ways of tagging, although we need to be careful: we likely don't want to trigger tag builds for -dev tags which are usually added on master.)