When Quark is installed alongside Corail Tombstones and the wither skeletons (may also apply to other mobs but I didn't have the patience to hunt for all of them) repeatedly (ca. 20 times) hit the player while it has a curse of bones enchantment applied on the chestplate the server (also included the integrated server) crashes due to a concurrent modification exception.

The issue is penultimately caused by CorailTombstone (see Corail31/tombstone_lite#179) removing and adding net/minecraft/world/entity/monster/AbstractSkeleton$1 the the goal selector of the entity while the goal selector iterates over all available goals. On it's own that doesn't cause a crash as net/minecraft/world/entity/monster/AbstractSkeleton$1 is added as the last goal and the Iterator completes after processing that goal. However, when Quark is installed, Quark adds a goal (I cannot remember which one it was but at this point there is no point figuring it out) after net/minecraft/world/entity/monster/AbstractSkeleton$1. As CorailTombstone doesn't seem to want to fix it on their side, Quark should reorder the insertion order to fix it on it's side - this is possible due to the ordering semantics of LinkedHashMap.

Relevant crash report with just the infringing mods present: https://gist.github.com/Geolykt/941ece59005eb677fc9202890540e16f

Let me dig into the log real quick and get a better idea

Actually this seems like it's more on sloppy vanilla code that this combination of factors is making break

... I feel like this is very much their problem, not ours

At this point I don't know who to believe.

So, an explanation is in order.

If a Skeleton is killed and drops its weapon, it will reassess its goals. That's what makes the goals change, and causes the CME. You were correct that it was occurring during AbstractSkeleton$1 (which is a MeleeAttackGoal), which is the problem.
Because the thorns - or bone shield, in Corail's case - damage is being dealt during goal execution of the MeleeAttackGoal or RangedBowAttackGoal, this will cause a CME if the attack goal is not the very last goal in the set, as you surmised.

Is this stupid? Yes!

The only particularity of the Curse of Bones is when BoneShield is active, the damages are 'thorns' (and it doesn't reflect thorns damages).

This is correct. All that's happening is damage is being dealt reactively.

I think I might be able to recreate this with Quark alone.

Reproduced. Fun.

tl;dr: Corail did nothing wrong. What we did wrong shouldn't have been wrong... but mojang gonna mojang.