[security] Make frro iteration thread-safe

Add a lock over all frro iterator methods to make sure the
iterator isn't changed or removed from under the iteration
call while it's running.

+ Also introduce an ID ensuring the caller is the same for
  all the acquire/next/release methods

+ a bit of moves where they were supposed to be from the start

Bug: 245727875
Test: manual + presubmits
Change-Id: Ie585b6d113ebddee491c9ee433f070bed71a57cc