swarm-nats-auth: answer callout requests concurrently, skip expired ones

Each request now runs in its own task, at most CONCURRENT_REQUESTS (32)
at once, instead of being awaited inline by the subscription loop. A
request whose exp (nats-server sets it to send time plus its
authorization.timeout) has passed is skipped without a lookup or reply.

Fixes #5434.

swarm-nats-auth/src/agent_token.rs

@@ -37,9 +37,9 @@ pub fn classify(token: &str) -> Presented<'_> {
 /// The grant for an agent token, or `None` for a denial.
 ///
 /// The store lookup is bounded by introspection's budget, under the server's
-/// `authorization.timeout`. The callout loop answers one request at a time, so
-/// a store that does not answer holds every request behind it, OIDC ones
-/// included, for at most that long, and this then denies.
+/// `authorization.timeout`. A store that does not answer holds one of the
+/// responder's `CONCURRENT_REQUESTS` permits for at most that long, and this
+/// then denies.
 pub async fn authorize(
     policy: &Policy,
     source: &impl CredentialSource,
@@ -133,8 +133,8 @@ mod tests {
         );
     }
 
-    /// The callout loop answers one request at a time, so a store that never
-    /// answers must cost at most the bound, and then deny.
+    /// A store that never answers holds a request's permit, so it must cost
+    /// at most the bound, and then deny.
     #[tokio::test]
     async fn a_store_that_never_answers_is_denied_within_the_bound() {
         let bound = crate::introspect::INTROSPECTION_TIMEOUT;