Fix rare concurrency issue in back-office auth middleware

[kjac]

Prerequisites

• I have added steps to test this contribution in the description below

Description

It is apparently possible to trigger a concurrency exception in the BackOfficeAuthorizationInitializationMiddleware.

I have not been able to reproduce it, but here's a screenshot of the error (sent by a colleague):

This PR fixes it. I'm erring on the side of caution here, since the PR targets V16 RC. It could likely be solved in a different way using ConcurrentBag<string> instead of HashSet<string>() to store the known hosts, but since we still need to perform explicit locking to avoid duplicate updates of back-office hosts, I think this is an OK solution.

Testing this PR

As mentioned, I can't reproduce the issue myself. So most of all, a visual inspection of the code is in order - and then a verification that the back-office still works 😆

[AndyButland]

Code looks good and correct to solve the reported issue. As noted, manual testing can't be much more than loading up the backoffice and logging in - but I've done what without seeing any issues.