Fix race condition in FaultInjectionMetadataStore#programmedFailure

[Jason918]

Motivation

org.apache.pulsar.metadata.impl.FaultInjectionMetadataStore#programmedFailure is not thread safe.
Multi threads can get the same failure at the same time (At Line 195), resulting one failure returned multiply times, which I believe is not the design purpose.

Modifications

Only return failure when remove is success. (failures is a thread safe list.)

Verifying this change

• Make sure that the change passes the CI checks.

This change is already covered by existing tests, such as ManagedLedgerErrorsTest

Does this pull request potentially affect one of the following parts:

If yes was chosen, please highlight the changes

• Dependencies (does it add or upgrade a dependency): (no)
• The public API: (no)
• The schema: (no)
• The default values of configurations: (no)
• The wire protocol: (no)
• The rest endpoints: (no)
• The admin cli options: (no)
• Anything that affects deployment: (no)

Documentation

Check the box below and label this PR (if you have committer privilege).

Need to update docs?

• no-need-doc
  Bug fix

[Jason918]

@eolivelli PTAL. It's the same issue you mentioned in #13005