NXCM-5448: move resolver cache check to before we even attempt to read-lock the configuration (note: this is only viable if we don't need to invalidate the resolve cache when DynamicSecurityResources change)