feat: acquire lock around visibility change callback

Similarly to how the refresh token ticker needs to acquire the lock before checking whether the session needs to be refreshed, we need to do the same for the visibility change callback. This is difficult to spot because when one uses tabs instead of windows, there's often just one tab visible at once. But when using multiple windows, a window is not hidden when not focused, so events like waking from sleep will cause all windows to refresh the token at once. Adding the lock will serialize access, meaning that all windows will check the session, but only one will refresh.

supabase / auth-js

feat: acquire lock around visibility change callback #764