swarm-agent-verify: lift the agent-token store check out of swarm-nats-auth

`CredentialSource`, `Store` and `verify` move from swarm-nats-auth's
`agent_token` module into a small library crate, so a second verifier
can make the same check: the secret in a `swarm-agent.<agent>.<secret>`
token equals the one stored at `swarm/agents/<agent>/queue`, read under
the verifier's own certificate.

`verify` now takes its timeout as an argument; swarm-nats-auth passes
`INTROSPECTION_TIMEOUT` as before. No behaviour change. The store-denial
tests moved with the code; swarm-nats-auth keeps the ones that go
through its policy and its bound.

Part of #4459.

Cargo.lock

@@ -4789,6 +4789,18 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "swarm-agent-verify"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "subtle",
+ "swarm-queue-client",
+ "swarm-secret-client",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "swarm-authelia-bridge"
 version = "0.1.0"
@@ -4910,7 +4922,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.11.0",
- "subtle",
+ "swarm-agent-verify",
  "swarm-queue-client",
  "swarm-secret-client",
  "tokio",