Change SafeContract locking scheme

This changes SafeContract to be more in line with existing locking conventions.

The mutex guarding the contract header, headerMu, has been renamed to mu and now covers all fields of the SafeContract.

The mutex that serializes revisions, mu, has been renamed to revisionMu. Its scope is unchanged.

The commit and record methods of SafeContract hold the new mu for the duration of the call. Other unexported methods do not acquire mu directly, but (following convention) they should be called with the mutex held.

Changing the locking scheme turned up some NDFs in the contractor tests, where threadedContractMaintenance was forming contracts before the tests could manually call managedNewContract. I'm not sure why the locks affected this, but I fixed it by adding a short sleep to allow the contractor to finish performing maintenance before the test sets the allowance.