We should protect the client and token secrets with locks:

https://github.com/envoyproxy/envoy/blob/main/source/extensions/filters/http/oauth2/filter.h#L60

Report: https://envoyproxy.slack.com/archives/C78HA81DH/p1652217023289709

cc: @derekargueta @snowp @fishcakez @JuniorHsu