Remove races from JNI_OnLoad invocation.

Remove races from JNI_OnLoad invocation.

Do not merge to master.  (This was copied from there to donut.)

The current implementation just calls JNI_OnLoad and returns a failure
result if that goes badly.  If a second load attempt is made after
dlopen() finishes but before JNI_OnLoad completes, it will succeed
immediately.

This is bad because (a) we might not have finished the initialization
steps in JNI_OnLoad, and (b) it's possible JNI_OnLoad will fail.  We now
wait for an in-progress JNI_OnLoad to complete before returning.  (This
also requires recognizing and handling recursive invocation.)