Fix downstream race conditions with NewAccountFunc

These functions typically modify the ACMEIssuer.
Only one such consumer of this API is known (Caddy).

acmeclient.go

@@ -68,7 +68,10 @@ func (iss *ACMEIssuer) newACMEClientWithAccount(ctx context.Context, useTestCA,
 	// register account if it is new
 	if account.Status == "" {
 		if iss.NewAccountFunc != nil {
+			// obtain lock here, since NewAccountFunc calls happen concurrently and they typically read and change the issuer
+			iss.mu.Lock()
 			account, err = iss.NewAccountFunc(ctx, iss, account)
+			iss.mu.Unlock()
 			if err != nil {
 				return nil, fmt.Errorf("account pre-registration callback: %v", err)
 			}

acmeissuer.go

@@ -132,7 +132,7 @@ type ACMEIssuer struct {
 	// synchronize properly.
 	email  string
 	agreed bool
-	mu     *sync.Mutex // protects the above grouped fields
+	mu     *sync.Mutex // protects the above grouped fields, as well as entire struct during NewAccountFunc calls
 }
 
 // NewACMEIssuer constructs a valid ACMEIssuer based on a template