Document (lack of) thread-safety

[husberg-disguise]

The API generally assumes all calls are on a single thread, except for some thread-safe functions (logging and status).

Document which are safe and which require a mutex.