Move mForceDeniedNapps check into synchronized block

This fixes a race condition that existed when using the test command
that allows force denying access to a nanoapp. This race condition
occurred when updateNanoAppAuthState was called immediately following
the force denial command invocation which meant that it was waiting on
the lock to be released after the force denial went through and was
using stale mForceDeniedNapps which caused the authorization to be
granted again.

Fixes: 187437820
Test: atest PtsChreTestCases
Change-Id: I39fc05abc95f3d7fe0c929ddce9b212f729506c5

services/core/java/com/android/server/location/contexthub/ContextHubClientBroker.java

@@ -665,7 +665,7 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
             long nanoAppId, List<String> nanoappPermissions, boolean gracePeriodExpired) {
         return updateNanoAppAuthState(
                 nanoAppId, nanoappPermissions, gracePeriodExpired,
-                mForceDeniedNapps.contains(nanoAppId) /* forceDenied */);
+                false /* forceDenied */);
     }
 
     /**
@@ -705,7 +705,7 @@ public class ContextHubClientBroker extends IContextHubClient.Stub
             // DENIED_GRACE_PERIOD -> DENIED only if the grace period expires
             // DENIED/DENIED_GRACE_PERIOD -> GRANTED only if permissions are granted again
             // any state -> DENIED if "forceDenied" is true
-            if (forceDenied) {
+            if (forceDenied || mForceDeniedNapps.contains(nanoAppId)) {
                 newAuthState = AUTHORIZATION_DENIED;
                 mForceDeniedNapps.add(nanoAppId);
             } else if (gracePeriodExpired) {