Move ssrcs_ and payload_types_ to the network thread

Moves the remaining demuxer criteria related variables in the channel
classes, ssrcs_ and payload_types_, to the network thread. State updates
are now passed as optional parameters and inlined into
`MaybeUpdateDemuxerAndRtpExtensions_w` and `RegisterRtpDemuxerSink_w`.
These methods apply the modifications atomically within a blocking call
to the network thread.

Specific changes include:
* Updating annotations to `RTC_GUARDED_BY(network_thread())`.
* Removing `MaybeAddHandledPayloadType` to construct payloads prior
  to the thread hop.
* Restricting `demuxer_criteria()` to run only on the network thread.

Bug: webrtc:42222117
Change-Id: If5a14bd5626536118e3caa7c87237a94d7ba2230
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/456300
Reviewed-by: Henrik Boström <hbos@webrtc.org>
Commit-Queue: Tomas Gunnarsson <tommi@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#47179}