[native] Guarantee thread safety during the map async callback.

- This change makes the pending map mutex into a recursive one so
  that it can be held throughout the duration of the map async
  callback. This ensures that during the callback, there cannot be
  a race with Unmap or Destroy.
- This addresses the security bug below by because on the server,
  the call to GetMappedRange always happens in the scope of the map
  async callback. This means that even if an Unmap or Destroy
  races, either the Unmap/Destroy will happen first, thereby
  resulting in a failed map async callback, or the callback will
  happen first before the Unmap goes through.
- Note that we needed to use a recursive mutex instead of a normal
  one because otherwise, a map async callback that calls Unmap
  would deadlock.

Bug: 517692772
Change-Id: I25068c3722a138ec3014a5b942457e5d484462ec
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/313216
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Reviewed-by: Kyle Charbonneau <kylechar@google.com>
Commit-Queue: Loko Kung <lokokung@google.com>