The `UpdaterWithHooks` structure is a wrapper around the `Updater`
struct which knows to manually execute hooks such that it behaves like a
git-receive-pack(1) would. The order is a off though: we lock refs after
we have executed the reference-transaction hook and migrated objects
from any potential quarantine directory into the main object store. This
means that a concurrent update to a subset of the same refs could
succeed. This is especially bad in the context of strong consistency: we
have already concluded our first vote and determined that changes should
be committed to disk, but afterwards some nodes may fail due to races.

Partially fix this issue by locking refs before we execute the
reference-transaction hook and thus the vote, which is also the same
order Git uses. This is a partial fix only though because we don't have
any way to verify that locking succeeded right now, so all we can do for
now is to cross our fingers and hope that things will be locked by the
time we vote on refs.