Use a real Windows lock for the file token store

The initial Windows shim made the package compile but its lock was a no-op, so two concurrent file-store writers could lose an update or collide on the shared ".tmp" file. Use LockFileEx/UnlockFileEx (golang.org/x/sys/windows, already a dependency) on the ".lock" file for the same blocking, interprocess advisory exclusion the Unix path gets from flock, which serializes writeFileToken's read-modify-write. Promotes golang.org/x/sys to a direct dependency.