Clarify VehiclesForAgencyID lock ownership and fix test locking

[Adityatorgal17]

Summary

Clarifies static lock ownership for vehicles-for-agency and fixes missing test-side locking for static GTFS manager access.

Changes

• Hold api.GtfsManager.RLock() for the full duration of vehiclesForAgencyHandler
• Make VehiclesForAgencyID require caller-held manager.RLock()
• Update direct VehiclesForAgencyID test call sites to follow that contract
• Add missing RLock() in the OpenAPI conformance tests before static manager reads

Why

Previously, vehiclesForAgencyHandler only held RLock() for the initial agency lookup, then released it before continuing with other static-dependent work such as VehiclesForAgencyID and DB-backed route/reference reads.

This split the handler's static reads across multiple lock windows instead of one clear snapshot boundary. During ForceUpdate, static data, lookup maps, indexes, and GtfsDB are swapped under the write lock, so different parts of a single response could otherwise be built from different static snapshots.

This change makes lock ownership explicit:

• The handler owns the static read lock for its full duration
• VehiclesForAgencyID assumes the caller already holds it
• Tests now follow the same contract

Validation Passed

~ make test

Fixes #795