Make RoleUserState use its own lock.

This change makes RoleUserState to use its own lock, so that it can
access its own lock whenever it wants. This change also fixes the
issue that getting controller service wasn't properly locked, and
getting role holders didn't return a copy of data to prevent parallel
modification.

Bug: 110557011
Test: manual
Change-Id: I922fce09a62e15da1be7138d34d9a3583513e40e