Consul lock executes children under a shell, which was previously
undocumented. Document it, and warn against cases where this can cause
children to leak when the lock is lost.
I have made this a dedicated section so it can easily be removed
later when we move to exec
https://github.com/hashicorp/consul/issues/1692