Protect against concurrent duplicated webhooks

[waiting-for-dev]

Summary

By acquiring an update lock on the payment, we can ensure that only one concurrent excecution of the webhook handler will manipulate it. That will avoid duplicated log entries and obscure exceptions.

Closes #188

Checklist

Check out our PR guidelines for more details.

The following are mandatory for all PRs:

• [x] I have written a thorough PR description.
• [x] I have kept my commits small and atomic.
• [x] I have used clear, explanatory commit messages.

The following are not always needed:

• 📖 I have updated the README to account for my changes.
• 📑 I have documented new code with YARD.
• 🛣️ I have opened a PR to update the guides.
• ✅ I have added automated tests to cover my changes.
• 📸 I have attached screenshots to demo visual changes.