[w-goog]

• Change @synchronized(self) to synchronize on a private lock, to prevent other callers from battling for the user object's lock. The private lock remains recursive, because AppAuth calls didChangeState / KVO observers may need to re-enter.
• Update the refresh path to use said lock.
• Update emmSupport and encodeWithCoder to use said lock.
• Known follow-up: Other readers grab authState without the lock. Tracked in GIDGoogleUser.authState is sometimes read without a lock #648.

[gemini-code-assist]

Code Review

This pull request replaces @synchronized(self) with a recursive lock (_authStateLock) in GIDGoogleUser to serialize auth state updates and reads, avoiding potential deadlocks during KVO notifications. Feedback on the changes identifies a potential crash in refreshTokensIfNeededWithCompletion: if lastTokenAdditionalParameters is nil, as passing nil to addEntriesFromDictionary: raises an exception. A guard or fallback dictionary is recommended to prevent this crash.