Synchronize access to sClientCertificateReferenceWorkaround

Also, refactor for easier readability.
Remove KeyChainKeyManager's dependency on 'K9.app'
Make fields in KeyChainKeyManager final