Mutual exclusion in API calls

the hardest part usually is not a queue, but finding all places where it should be called to make sure that non thread-safe apis are not exposed to the client

@tsmaeder please open an issue for it

done: https://github.com/theia-ide/theia/issues/5820