Limit the number of concurrent process spawns

In #823 (closed) we learned that Go has a global lock (syscall.ForkLock) for spawning subprocesses, and that bad things happen to Gitaly when it keeps accepting new requests that all end up waiting for syscall.ForkLock.

Switching to Go 1.9 should make it unlikely that this happens again on Linux/amd64. Nevertheless, as a precaution, and for the benefit of other platforms, this change adds a safety valve that bounds the parallelism of process spawning (no more than 100 parallel spawns), and lets requests fail early if waiting for a turn to spawn a process takes unusually long (more than 10 seconds).