CppTodoItemsScanner and QmlJsTodoItemsScanner trigger undefined behavior

In these classes, a Qt::DirectConnection is created to signals of the C++ and QmlJs code models, respectively, and in the associated slots API functions from other plugins are called, e.g. ProjectExplorer::Project::files(). This is seriously wrong, as these functions are not thread-safe. Not surprisingly, crashes due to this code have been observed.
Unfortunately, the fix is not trivial, as a QueuedConnection also results in a crash, presumably because the TODO plugin calls back on the code models with the assumption that they are in the exact same state in which they emitted the signal.