Implement more stringent thread-safetyness in `rcutils_getenv`

There's a lot of detail in https://github.com/ros2/rcutils/pull/237#discussion_r408151034 , but to summarize the situation we are now in:

As of https://github.com/ros2/rcutils/pull/237, on all platforms rcutils_get_env is thread-safe for simultaneously getting environment variables from separate threads. It is currently unsafe in the following cases:

1. Getting an environment variable, holding onto the pointer, and then having a later method (in the same or different thread) call setenv. In that case, the pointer may be invalidated, but there is no way of knowing.
2. Getting an environment variable in one thread while setting an environment variable from a separate thread at the same time (this is a well-known limitation of glibc, for instance).

The first issue can be solved by changing the contract of rcutils_get_env to take an allocator, allocate space, copy the contents of the environment variable into that space, and then having the caller free the memory when they are done.

The second issue can be solved by adding locking around getting environment variables and setting environment variables.

Start with the rcutils_get_env API and the related setenv call paths, then read the design discussion in pull request 237. Define the allocator and locking contract across supported platforms; done means returned values remain valid after environment changes and concurrent reads and writes are safe.