[CDM] Add a lock for package callbacks

This is to resolve race condition that CDM receives the same callback
twice, which causes the second callback couldn't find associations.

Fix: 420760732
Test: CTS
Flag: EXEMPT bugfix
Change-Id: I03c6f3a1c55a76544ad0b1697ad4f43f208a4c63