Fix concurrent modification exception on sorting (#5952)

* Fix concurrent modification exception on sorting

```
Caused by: java.lang.IllegalStateException: Unable to get values of org.jspecify:jspecify:1.0.0
	at org.openrewrite.maven.tree.ResolvedPom.getValues(ResolvedPom.java:1227)
	at org.openrewrite.maven.tree.ResolvedPom.resolveDependencies(ResolvedPom.java:1011)
	at org.openrewrite.maven.tree.ResolvedPom.resolveDependencies(ResolvedPom.java:984)
	at org.openrewrite.maven.tree.MavenResolutionResult.resolveDependencies(MavenResolutionResult.java:189)
	... 18 common frames omitted
Caused by: java.util.ConcurrentModificationException: null
	at java.base/java.util.ArrayList.sort(ArrayList.java:1723)
	at org.openrewrite.maven.tree.ResolvedPom.getDependencyManagement(ResolvedPom.java:145)
	at org.openrewrite.maven.tree.ResolvedPom.getManagedDependency(ResolvedPom.java:379)
	at org.openrewrite.maven.tree.ResolvedPom.getManagedExclusions(ResolvedPom.java:369)
	at org.openrewrite.maven.tree.ResolvedPom.getValues(ResolvedPom.java:1204)
	... 21 common frames omitted
```

* Avoid `new CopyOnWriteArrayList()` call in constructor

This is bad for deserialization.

---------

Co-authored-by: Knut Wannheden <knut@moderne.io>

Author: pstreef

rewrite-maven/src/main/java/org/openrewrite/maven/tree/ResolvedPom.java

@@ -104,6 +104,7 @@ public ResolvedPom(Pom requested, Iterable<String> activeProfiles) {
     @Builder.Default
     List<ResolvedManagedDependency> dependencyManagement = emptyList();
 
+    // TO-BE-REMOVED(2025-11-30): See comment on `getDependencyManagement()`
     @NonFinal
     @Builder.Default
     @Getter(AccessLevel.NONE)
@@ -139,11 +140,16 @@ public ResolvedPom(Pom requested, Iterable<String> activeProfiles) {
     List<String> subprojects = emptyList();
 
     // Annotation present to ensure that serialized data is always sorted
+    // TO-BE-REMOVED(2025-11-30): Remove this method and instead do simpler eager sorting in `resolveParentDependenciesRecursively()`.
+    //   This cannot be changed right now, because in older serialized models the data is unsorted.
     @JsonGetter
     public List<ResolvedManagedDependency> getDependencyManagement() {
         if (!dependencyManagementSorted) {
-            dependencyManagement.sort(MANAGED_DEPENDENCY_COMPARATOR);
-            dependencyManagementSorted = true;
+            // Some use cases require concurrent calls to this method
+            synchronized (this) {
+                dependencyManagement.sort(MANAGED_DEPENDENCY_COMPARATOR);
+                dependencyManagementSorted = true;
+            }
         }
         return dependencyManagement;
     }