identity/group-alias: add api client lock

[fairclothjm]

Description

Relates #1695

I haven't been able to reproduce the issue from #1695 yet, but the lack of locking here is quite suspicious.

Checklist

• [x] Added CHANGELOG entry (only for user-facing changes)
• [ ] Acceptance tests where run against all supported Vault Versions

[fairclothjm]

Looking into the test timeout failures: https://github.com/hashicorp/terraform-provider-vault/actions/runs/7890026265/job/21531339605