The ban lurker checks bans concurrently to lookup. Lookup checks are better
informed then ban lurker checks, in particular because they have access
to request information and can thus check request bans.

So, do not touch ocs which were moved concurrent to the ban lurker working them.

Unprotected access to oc->ban may be outdated, so re-check under the ban_mtx.

Idea for great simplification by
Martin Blix Grydeland <martin@varnish-software.com>