[BUG] DiscoveryDataChangedEventSyncListener.discoverySyncDataList is a non-thread-safe ArrayList mutated across threads

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/discovery/DiscoveryDataChangedEventSyncListener.java:71,86,166-173`
- description: `discoverySyncDataList` is a plain `new ArrayList<>()` (line 71). It is mutated by `addListener` (lines 167-173, using `stream().noneMatch` + `add`) from the request/startup thread, and iterated by `onChange` (`discoverySyncDataList.forEach`, line 86) on the registry watch-callback thread. These are different threads operating on an unsynchronized `ArrayList`.
- impact: Intermittent `ConcurrentModificationException` in the watch thread (kills that watch notification), or a selector's upstream changes silently dropped because its context wasn't yet visible to the iterating `onChange`.
- suggested_fix: Use `CopyOnWriteArrayList` for `discoverySyncDataList`, or synchronize `addListener`/`onChange` on a shared lock.
- confidence: Medium-High
- related_existing: none. PERF-11 flags the second HashMap in `AbstractDiscoveryProcessor`; this is a different field in a different class.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with shenyu-admin/src/main/java/org/apache/shenyu/admin/discovery/DiscoveryDataChangedEventSyncListener.java, reading discoverySyncDataList and the addListener and onChange methods at the cited lines. Check the existing shenyu-admin test coverage for this listener and reproduce or reason about concurrent registration and watch callbacks. Done means listener updates are safely visible and watch notifications no longer fail or drop changes under concurrent access.

Written by the indexing model from the issue text.