Lock the public IP allocation before a server move

A public IP move re-reads and locks the allocation first, so a second move to the same server does nothing instead of failing with TimestampMismatchError.