Lock group(s) when creating instances

This is required to prevent race conditions such as removing a network
from a group and adding an instance at the same time. (See issue 621#2.)

Signed-off-by: Petr Pudlak <pudlak@google.com>
Reviewed-by: Thomas Thrainer <thomasth@google.com>
Reviewed-by: Michele Tartara <mtartara@google.com>