User-supplied processor code runs while holding the span's write lock #970

SpanModel.endInternal invokes processor.onEnding(ReadWriteSpanImpl(this)) inside lock.write,
and addEvent/addLink invoke the caller's AttributesMutator lambda inside mutate { }, which
is also the write lock.

Reads from the same thread are fine, but a user could plausibly hand the reference to another thread and block
waiting for it, which would deadlock. We should avoid the potential for this by ensuring processor.onEnding isn't called from within lock.write, but simultaneously we do need to enforce that endInternal can only run once.