fix: dev: Change catz coo locking

Catalog zones might need to inspect the change-of-ownership records
of other catalog zones, which required to release the lock in the
middle of certain operations, leading to possible race conditions.

Since the operations on change-of-ownership records are limited, we
can instead use a design with a second lock protecting the
change-of-ownership records on read. We structure the API so that
holding two change-of-ownership locks at the same time is impossible.

Closes #6131

Merge branch '6131-catz-dns__catz_zones_merge-uaf-fix-v2' into 'main'

See merge request isc-projects/bind9!12277