fix: thread-safe cache writes and feature update handling

[vazarkevych]

Problem

Several race conditions existed in cache and feature update handling:

• InMemoryFeatureCache had no locking — concurrent reads/writes could corrupt cache entries
• FeatureRepository.load_features and load_features_async had no double-checked locking — multiple threads/coroutines could trigger redundant HTTP fetches simultaneously
• _feature_update_callbacks list was mutated and iterated without a lock — concurrent add/remove/notify could raise RuntimeError: list changed size during iteration
• _sticky_bucket_cache_lock was a boolean flag instead of a real lock — the spin-loop was not thread-safe and silently returned {} when the "lock" was held
• FeatureCache.get_current_state returned a mutable reference to savedGroups instead of a copy
• GrowthBook.load_features_async called save_in_cache with wrong cache key (client_key instead of api_host::client_key), making the cached value unreachable
• _features_event_handler had the same incorrect cache key

Changes

• InMemoryFeatureCache: added threading.Lock to get, set, clear
• FeatureRepository: added _load_lock and _async_load_lock with double-checked locking pattern in load_features and load_features_async
• _feature_update_callbacks: protected add/remove with _refresh_lock; _notify copies the list under the lock and iterates outside to prevent deadlocks from slow callbacks
• _sticky_bucket_cache_lock: replaced boolean spin-lock with asyncio.Lock(); simplified _refresh_sticky_buckets
• FeatureCache.get_current_state: returns dict() copy of savedGroups
• GrowthBook.load_features_async: removed redundant save_in_cache call (already handled by FeatureRepository)
• _features_event_handler: fixed cache key to api_host::client_key; changed return None to return

[madhuchavva]

@vazarkevych - thanks for identifying these tricky issues.

I guess the most pressing issue here is: the cache-miss stampede in FeatureRepository.load_features / load_features_async: if many threads or coroutines ask for the same uncached SDK payload at once, they can all hit the GrowthBook API/CDN simultaneously.

and, P2 list includes callback list mutation during notification, sticky bucket boolean lock. but the blast radius is limited. so, I’d salvage this by porting these ideas onto current main: thread-safe InMemoryFeatureCache, snapshot callback delivery, per-key fetch coalescing for sync/async loads, savedGroups copy semantics, and real sticky-bucket lock. There are many changes that went in and we'll need to preserve current remote-eval cache keys, force_refresh, SSE invalidation, and async client behavior.

[madhuchavva]

resolve the conflicts and address the review comments please