internal/server: fix data race on broadcast set

The broadcast set is accessed from within HTTP handlers whereas at least one of those accesses is a write operation.

Fix the resulting data race by synchronizing access using a mutex.

Fixes #1 (closed).