Consul lock executes children under a shell, which was previously
undocumented. Document it, and warn against cases where this can cause
children to leak when the lock is lost.
I have made this a dedicated section so it can easily be removed
later when we move to exec
https://github.com/hashicorp/consul/issues/1692
Previously, it would try once "up to" the timeout, but in practice it would
just fall through. This modifies the behavior to block until the timeout has
been reached.
