fix(onepassword): return fresh provider instance from NewClient to avoid wrong-vault race (#6334)

NewClient mutated the singleton receiver's vaults/client fields and
returned the receiver itself, so a parallel NewClient(otherStore) on
the same registered provider would overwrite provider.vaults between
NewClient returning and the caller's GetSecret/GetSecretMap call. The
mutex added in #4839 only serialises individual methods, not the
client lifetime, so findItem then iterates the wrong store's vault
map and emits 'key not found in 1Password Vaults: X in: map[Y:1]'
errors against unrelated stores.

Mirrors the fix applied to the onepasswordsdk provider in #5921.

Refs: #4663, #5920

Signed-off-by: diouze <julien.duizabo@airnity.com>
Co-authored-by: Gergely Bräutigam <gergely.brautigam@sap.com>

providers/v1/onepassword/onepassword.go

@@ -115,8 +115,6 @@ func (provider *ProviderOnePassword) Capabilities() esv1.SecretStoreCapabilities
 
 // NewClient constructs a 1Password Provider.
 func (provider *ProviderOnePassword) NewClient(ctx context.Context, store esv1.GenericStore, kube kclient.Client, namespace string) (esv1.SecretsClient, error) {
-	provider.mu.Lock()
-	defer provider.mu.Unlock()
 	config := store.GetSpec().Provider.OnePassword
 	token, err := resolvers.SecretKeyRef(
 		ctx,
@@ -128,9 +126,10 @@ func (provider *ProviderOnePassword) NewClient(ctx context.Context, store esv1.G
 	if err != nil {
 		return nil, err
 	}
-	provider.client = newRetryClient(connect.NewClientWithUserAgent(config.ConnectHost, token, userAgent))
-	provider.vaults = config.Vaults
-	return provider, nil
+	return &ProviderOnePassword{
+		client: newRetryClient(connect.NewClientWithUserAgent(config.ConnectHost, token, userAgent)),
+		vaults: config.Vaults,
+	}, nil
 }
 
 // ValidateStore checks if the provided store is valid.