add callOnce

- uses double-checked locking (the correct one)

- all instances shared the same global mutex

- minimal overhead and simple API
Do we want to have a template constraint making sure that `callable` is callable?