libbinder: also avaid sWarningCallback lock

Since binders are made in FastNative or CriticalNative
code, they may be called while holding the mutator lock,
which another thread may try to lock, which already holds
the native lock held here.

This was previously fixed for calls to sLimitCallback, but
this fixes things for sWarningCallback as well, which was
added later.

Bug: 372506687
Bug: 354286280
Bug: 199683153
Bug: 352692435
Test: boot
Change-Id: Iafe1208b331df74ad2b2117ae0ceab4663f53c41

Author: Steven Moreland

libs/binder/BpBinder.cpp

@@ -197,7 +197,9 @@ sp<BpBinder> BpBinder::create(int32_t handle, std::function<void()>* postTask) {
                     && currentValue < sBinderProxyCountHighWatermark
                     && ((trackedValue & WARNING_REACHED_MASK) == 0)) [[unlikely]] {
                 sTrackingMap[trackedUid] |= WARNING_REACHED_MASK;
-                if (sWarningCallback) sWarningCallback(trackedUid);
+                if (sWarningCallback) {
+                    *postTask = [=]() { sWarningCallback(trackedUid); };
+                }
             } else if (currentValue >= sBinderProxyCountHighWatermark) {
                 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
                       getuid(), trackedUid, trackedValue);