Make installer's `Ensure`/`Install` & `Remove` methods thread-safe

While reading the relevant code I realized that we make (somewhat unconscious) assumption that the state (removable files) only survives until the next Ensure or Install call, so the user can't really call both or one of those repeatedly, unless they also always call Remove before.

There is a number of problems related to thread-safety currently:

https://github.com/hashicorp/hc-install/blob/e677aa47db3261deb1ae1583887915066593d8aa/installer.go#L17

We track the state in a slice which isn't guarded by any synchronization mechanism, so if someone was to call `Ensure` and `Remove` at the same time this could result in a data race condition.

Additionally the state is shared between both `Ensure` and `Install` methods and the `Remove` method would just remove any removable files that are currently present in the slice.

https://github.com/hashicorp/hc-install/blob/e677aa47db3261deb1ae1583887915066593d8aa/installer.go#L126-L133

Start in installer.go at the state definition around line 17, then trace Ensure, Install, and Remove, especially lines 126-133. Determine how their shared removable-file state behaves when calls repeat or overlap; done means these methods can be used concurrently without data races or unintended cross-call cleanup.

Written by the indexing model from the issue text.