Synchronize all project authorization refreshing work using a lease
This ensures that all authorization refreshing work happens in an exclusive lease, instead of only using a lease when inserting/removing data. This fixes the race condition described in https://gitlab.com/gitlab-org/gitlab-ce/issues/25987.