Make sure that workflow invocations that mutate a document lock on the handle

Since with branch support, we do not have the orthogonality between workflow steps that introduce changes (for example we can now have that someone branches while a request node triggers a publication) we need to lock on handle when the workflow changes a document. Note that this was better in general already, but we never had a lightweight locking mechanism.