GIDGoogleUser.authState is sometimes read without a lock #648

AC:

• Reads & writes to GIDGoogleUser.authState are serialized under one lock. Multi-field reads must happen in the same lock acquisition.

Background:
GIDGoogleUser serializes its own authState updates & multi-field reads under a private lock. However, the following readers access it directly:

• GIDSignIn, for the addScopes and disconnect paths
• GIDEMMSupport accesses it via authSession.authState
• Apps can access it via fetcherAuthorizer. Worse still, the authorizer can also write to that state via -[OIDAuthState performActionWithFreshTokens:additionalRefreshParameters:].
• GTMAuthSession.primeForRefresh can also write to authState.

The full fix probably needs a lock inside OIDAuthState itself, or a public API change pushing reads via GIDGoogleUser & disallowing direct access. (OIDAuthState does not have an internal lock, currently)