Guard the provider cache against concurrent access

[btwshivam]

getOIDCProviderForIssuer reads and writes am.providers with no lock, which the code already flags with // FIXME: op not atomic.

two logins landing together for an issuer that isn't cached yet race on that map. Go doesn't make this a panic, it's fatal error: concurrent map writes, so neither recover() nor the grpc recovery interceptor catches it and revad exits.

map is empty after every restart, so the window is the first logins after one, which is also when a lot of people tend to log in at once. With more than one issuer configured a read racing a write is equally fatal, so it isn't only a startup thing.

guarded with a RWMutex and a re-check under the write lock. Discovery stays outside the lock, otherwise one unreachable issuer would block logins for every other issuer, and goes through a singleflight group so a burst costs the IdP one request instead of one per caller.

Testing

ran with -race against master the same tests report the data race and die with the fatal error, with the fix they pass. also assert that concurrent logins cause a single discovery request, dropping the singleflight makes that fail