Write a thread-safe rate limiter for an API endpoint that handles high traffic.
Implement allow_request(state, client_id, now, capacity, refill_rate), returning True when the client has a token and False otherwise. state is a shared dictionary, now is a nondecreasing timestamp in seconds, and refill_rate is tokens per second. The implementation must protect shared state during concurrent calls and avoid a single global lock bottleneck where practical.
def allow_request(state, client_id, now, capacity, refill_rate):