Improve thread safety guarantees

Just to explain why we haven't really spent a lot of time on this...I think the original design was that we'd use the Component interfaces and the "if initialized" guards to prevent mutations we didn't want, and we also got very sloppy because all the action beans are prototypes, so the whole design kind of became non-threadsafe over time and the other cases got more rare.

If anything, that probably means we should spend some time adding some annotations to the few classes that are actually designed to be singletons or immutable.

Sample of the changes for  to review (ordered by their impact):

1. Added synchronization to the getter (which is new in this case) and setter of certain fields e.g.  DuoIssuerClaimLookupStrategy.java

2. Ensure thread-safe classes that are properly guarded are marked @ThreadSafe. I have been cautious for most of these as there is no obvious get-then-set type issue, for example, the following has no public getters, but I guarded the fields in the NimbusClientFactory.java (so really it would have to be unsafely published in some way) - including use of the GuardedBy annotation.

3. One or maybe two missing final fields.

4. Added more @Immutable annotations to appropriate classes (which I know is not commonly used, so I could remove those to be consistent with the rest of the code base). 

5. Added ComponentSupport.ifDestroyedThrowDestroyedComponentException(this); where missing.

6. The rest are improvements to the Javadoc to more clearly indicate concurrency guarantees. 

Opening for review.

The result is, I will close this for now.

I'm sure this could be never ending, but I have at least made improvements to (Thanks to Ian for the chat):

• Document guarded fields (@GuardedBy)

  • Enforced the guarantee (I think) by using exclusive access to shared state e.g. synchronization. 

• Improved or ratified concurrency annontations.

• Ensured immutable classes were actually immutable - a few missing final statements. 

• Tested SpotBugs to see if it could help - useful for spotting some obvious issues with guarded variables being accessed unsafely.