testAndSet race condition causes duplicate target processing #2457
Description
testAndSet in runner.go does a non-atomic check-then-set: it calls seen(k) and then setSeen(k) separately. Under concurrent access (e.g. TLS SubjectAN/SubjectCN discovery in processTargets), two goroutines can both pass seen() before either calls setSeen(), resulting in the same target being processed twice.