Add a ThreadSanitizer build

This change adds a ThreadSanitizer CI build rule. It's informative for
now because there are still known places where there are races.

Part of: #5592

script/thread-sanitizer.supp

@@ -0,0 +1,18 @@
+# In attr_file_free, the locks are acquired in the opposite order in which they
+# are normally acquired. This is probably something worth fixing to have a
+# consistent lock hierarchy that is easy to understand.
+deadlock:attr_cache_lock
+
+# When invoking the time/timezone functions from git_signature_now(), they
+# access libc methods that need to be instrumented to correctly analyze the
+# data races.
+called_from_lib:libc.so.6
+
+# TODO(#5595): Remove these once the fixes land.
+race:src/odb.c
+race:git_repository_odb__weakptr
+race:cache_store
+
+# TODO(#5595): Investigate and fix this. It can be triggered by the `thread`
+# test suite.
+race:git_filter_list__load_ext