Concurrent first-touch of a setting could resolve it more than once.
Transformed results are now published as an immutable snapshot: reads are
lock-free (once a setting is resolved, an immutable Map makes it visible
for good via a @volatile field), and writes replace the whole map under a
single lock (copy-on-write) -- cheap, since each setting resolves at most
once, and in production every setting is pre-resolved single-threaded
during ready(). A single reentrant lock guards transformation because a
setting's getter may resolve its own dependencies by calling get() again
on the same thread; per-setting locks could deadlock on mutually-dependent
settings instead.

(cherry picked from commit ed1d009)