Add thread safety documentation for key types (#715)

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

Author: rdimitrov

metadata/multirepo/multirepo.go

@@ -51,7 +51,12 @@ type MultiRepoConfig struct {
 	DisableLocalCache bool
 }
 
-// MultiRepoClient represents a multi-repository TUF client
+// MultiRepoClient represents a multi-repository TUF client.
+//
+// Thread Safety: MultiRepoClient is NOT safe for concurrent use. If multiple
+// goroutines need to use a MultiRepoClient concurrently, external synchronization
+// is required (e.g., a sync.Mutex). Alternatively, create separate MultiRepoClient
+// instances for each goroutine.
 type MultiRepoClient struct {
 	TUFClients map[string]*updater.Updater
 	Config     *MultiRepoConfig

metadata/trustedmetadata/trustedmetadata.go

@@ -24,7 +24,11 @@ import (
 	"github.com/theupdateframework/go-tuf/v2/metadata"
 )
 
-// TrustedMetadata struct for storing trusted metadata
+// TrustedMetadata struct for storing trusted metadata.
+//
+// Thread Safety: TrustedMetadata is NOT safe for concurrent use. If multiple
+// goroutines need to access a TrustedMetadata instance concurrently, external
+// synchronization is required (e.g., a sync.Mutex).
 type TrustedMetadata struct {
 	Root      *metadata.Metadata[metadata.RootType]
 	Snapshot  *metadata.Metadata[metadata.SnapshotType]

metadata/updater/updater.go

@@ -58,6 +58,11 @@ import (
 //     target file is already locally cached.
 //   - DownloadTarget() downloads a target file and ensures it is
 //     verified correct by the metadata.
+//
+// Thread Safety: Updater is NOT safe for concurrent use. If multiple goroutines
+// need to use an Updater concurrently, external synchronization is required
+// (e.g., a sync.Mutex). Alternatively, create separate Updater instances for
+// each goroutine.
 type Updater struct {
 	trusted *trustedmetadata.TrustedMetadata
 	cfg     *config.UpdaterConfig