DefaultURLSecurityManager is not thread-safe

The DefaultURLSecurityManager introduced in XWIKI-10309 uses a simple HashSet to store the list of trusted domains but it is a singleton and dynamically adds the domain of the current request to the hash set. This could lead to concurrent modification of the set which is not thread-safe. Also, the initialization is not synchronized, leading to similar problems.

I assume it is unlikely that this causes any problems in practice, but it would still be good to fix this as the resulting errors would probably be quite obscure.