When a job merged an edge into another, mergeTo appended the dependency
cache keys to the target edge's secondaryExporters on the scheduler
goroutine. Cache export reads the same slice through the exporter of a
result loaded from that edge, and runs outside the scheduler, e.g. for
build history provenance or cache export while another build is still
running and merging into the shared edge.
Guard secondaryExporters with a mutex and let ExportTo iterate over a
copy, so nested exports run without holding the lock.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>