fix: avoid potential race conditions (#220)

* fix potential race condition during signer update

* avoid potential race conditions with lazy-initializers in OpenIDProvider

* avoid potential race lazy initializers in RelyingParty

* review feedback -- additional potential races

* add pre-calls to NewRelyingPartyOIDC too

pkg/op/op.go

@@ -167,6 +167,12 @@ func NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opO
 
 	o.crypto = NewAESCrypto(config.CryptoKey)
 
+	// Avoid potential race conditions by calling these early
+	_ = o.AccessTokenVerifier() // sets accessTokenVerifier
+	_ = o.IDTokenHintVerifier() // sets idTokenHintVerifier
+	_ = o.JWTProfileVerifier()  // sets jwtProfileVerifier
+	_ = o.openIDKeySet()        // sets keySet
+
 	return o, nil
 }