I assume ruff's updated a few things since last time it was run, as it
now fails.

Reported by @Rafiot: the lazy parser is not memoised, this has limited
effect on the basic / pure Python parser as its initialisation is
trivial, but it *significantly* impact the re2 and regex parsers as
they need to process regexes into a filter tree.

The memoization was mistakenly removed in ua-parser#230: while refactoring
initialisation I removed the setting of the `parser` global.

- add a test to ensure the parser is correctly memoized, not
  re-instantiated every time
- reinstate setting the global
- add a mutex on `__getattr__`, it should only be used on first access
  and avoids two threads creating an expensive parser at the same
  time (which is a waste of CPU)

Fixes ua-parser#253

In case where uap-core isn't a git repo (e.g. git archive), use uap-core's `package.json` as a fallback for getting a version.

Apparently the way submodules repos are configured leads to the branches not being mirrored locally (?) As such, the release job's fallback of checking out `'master'` fails whether triggered[^1] or scheduled[^2].

[^1]: https://github.com/ua-parser/uap-python/actions/runs/13090871627
[^2]: https://github.com/ua-parser/uap-python/actions/runs/13092233962

Since the environment is required via `workflow_dispatch`, the only fallback is scheduled release in which case we're publishing to pypy.

Turns out `'master'` probably worked all along as a fallback, the
problem is that I was using `'master '`, with a trailing space, which
was not a branch git managed to find for obvious reason, and since I
carried the error into the fully qualified reference... is still
didn't work.

And manual triggers didn't have the issue because the tag was
`required`, so I'd have to input the tag by hand every time, and the
fallback value would be bypassed.

- fix the fallback value
- remove the requirement on `tag`, such that it's possible to manually
  trigger the action in a default state