Add locking to the repos plugin

... so that we don't modify the priv->urls hash table concurrently from
multiple threads.

https://bugzilla.redhat.com/show_bug.cgi?id=1516536