We grab the lock while accessing the alternates list, ensuring that
we only initialize it once for the given git_odb.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>