[IMP] runbot_merge: lock commit to update its status in hook

A status being updated on a commit is a read/modify/update, meaning
it's possible for somebody else (including a concurrent event?) to
concurrently update the commit and conflict leading to the webhook
blowing up, which is undesirable as it's a data loss (whereas if it
blows up on the other side e.g. in the cron's commit processor the
cron will just take it up next iteration).

runbot_merge/controllers/__init__.py

@@ -220,7 +220,8 @@ def handle_status(env, event):
         event
     )
     Commits = env['runbot_merge.commit']
-    c = Commits.search([('sha', '=', event['sha'])])
+    env.cr.execute('SELECT id FROM runbot_merge_commit WHERE sha=%s FOR UPDATE', [event['sha']])
+    c = Commits.browse(env.cr.fetchone())
     if c:
         c.statuses = json.dumps({
             **json.loads(c.statuses),