Hold the pullLock while pulling regular container images, not just the
network container.
Also: previously, the locks were grabbed at too-low a layer in the
callstack, leaving a (narrow) window where images could be pulled and
then garbage collected before being used.
This change takes the existing pullLock a layer higher in the call stack
so the critical regions encompass the entire find+delete and pull+use
operation in both cases.
6f14e2e210