MM-44044: Fix racy TestGraphQLChannelMembers (#20155)

Upgrading the user resolver to dataloader
meant that multiple goroutines would access
the user struct.

Hence we move the user struct sanitization inside
the dataloader itself so prevent access outside
the dataloader.

https://mattermost.atlassian.net/browse/MM-44044

```release-note
NONE
```

api4/resolver_user.go

@@ -56,11 +56,6 @@ func getGraphQLUser(ctx context.Context, id string) (*user, error) {
 		}
 	}
 
-	if c.AppContext.Session().UserId == usr.Id {
-		usr.Sanitize(map[string]bool{})
-	} else {
-		c.App.SanitizeProfile(usr, c.IsSystemAdmin())
-	}
 	c.App.UpdateLastActivityAtIfNeeded(*c.AppContext.Session())
 
 	return &user{*usr}, nil
@@ -199,6 +194,18 @@ func getGraphQLUsers(c *web.Context, userIDs []string) ([]*model.User, error) {
 		return nil, appErr
 	}
 
+	// Same as earlier, we want to pre-compute this only once
+	// because otherwise the resolvers run in multiple goroutines
+	// and *User.Sanitize causes a race, and we want to avoid
+	// deep-copying every user in all goroutines.
+	for _, user := range users {
+		if c.AppContext.Session().UserId == user.Id {
+			user.Sanitize(map[string]bool{})
+		} else {
+			c.App.SanitizeProfile(user, c.IsSystemAdmin())
+		}
+	}
+
 	// The users need to be in the exact same order as the input slice.
 	tmp := make(map[string]*model.User)
 	for _, u := range users {