[BUG] ShenyuWebHandler.putExtPlugins mutates sourcePlugins without synchronization, races with onPluginEnabled

- Severity: Medium
- Location:
`shenyu-web/src/main/java/org/apache/shenyu/web/handler/ShenyuWebHandler.java:169` (`this.sourcePlugins.addAll(...)`), `:185` (`this.sourcePlugins.set(i, ...)`), `:240` (`onPluginEnabled` synchronized, reads `sourcePlugins`)
-
Description:
`putExtPlugins` (line 150, **not** synchronized) mutates `this.sourcePlugins` (an `ArrayList`, not thread-safe) via `addAll` and `set`. Meanwhile `onPluginEnabled` (line 240, `synchronized`) reads `sourcePlugins` via `.stream()`. `putExtPlugins` is called from `ShenyuLoaderService`'s scheduled executor thread (unsynchronized) and from `onPluginEnabled` itself. When the scheduled path runs concurrently with `onPluginEnabled`, the unsynchronized `ArrayList` mutation can race with `stream()` iteration → `ConcurrentModificationException`, lost updates, or corrupted internal array state.
-
Impact:
During concurrent plugin loading and enable/disable events: CME (500 errors), missing/duplicate plugins in chain, inconsistent plugin state.
-
Suggested fix:
Make `putExtPlugins` `synchronized`, or use `CopyOnWriteArrayList` for `sourcePlugins`.
-
Confidence: High
- Related existing: PERF-14 covers `BaseDataCache` list mutation races, a different class.

---

## B. shenyu-plugin-base (4 findings)

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in shenyu-web/src/main/java/org/apache/shenyu/web/handler/ShenyuWebHandler.java at putExtPlugins and onPluginEnabled, then trace the scheduled call from ShenyuLoaderService. Check how concurrent updates and stream iteration affect sourcePlugins, and review existing shenyu-web tests for coverage. Done means plugin loading and enable/disable events no longer produce concurrent collection failures or inconsistent plugin state.

Written by the indexing model from the issue text.