Fix rare concurrency issue in back-office auth middleware (#19418)

Author: kjac

src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs

@@ -65,13 +65,21 @@ private async Task InitializeBackOfficeAuthorizationOnceAsync(HttpContext contex
             return;
         }
 
-        if (_knownHosts.Add($"{context.Request.Scheme}://{context.Request.Host}") is false)
+        var host = $"{context.Request.Scheme}://{context.Request.Host}";
+        if (_knownHosts.Contains(host))
         {
             return;
         }
 
         await _firstBackOfficeRequestLocker.WaitAsync();
 
+        // NOTE: _knownHosts is not thread safe; check again after entering the semaphore
+        if (_knownHosts.Add(host) is false)
+        {
+            _firstBackOfficeRequestLocker.Release();
+            return;
+        }
+
         // ensure we explicitly add UmbracoApplicationUrl if configured (https://github.com/umbraco/Umbraco-CMS/issues/16179)
         if (_webRoutingSettings.UmbracoApplicationUrl.IsNullOrWhiteSpace() is false)
         {