swarm-agent-verify: lift the agent-token store check out of swarm-nats-auth

`CredentialSource`, `Store` and `verify` move from swarm-nats-auth's
`agent_token` module into a small library crate, so a second verifier
can make the same check: the secret in a `swarm-agent.<agent>.<secret>`
token equals the one stored at `swarm/agents/<agent>/queue`, read under
the verifier's own certificate.

`verify` now takes its timeout as an argument; swarm-nats-auth passes
`INTROSPECTION_TIMEOUT` as before. No behaviour change. The store-denial
tests moved with the code; swarm-nats-auth keeps the ones that go
through its policy and its bound.

Part of #4459.

swarm-nats-auth/Cargo.toml

@@ -23,17 +23,16 @@ serde.workspace = true
 serde_json.workspace = true
 # The jti digest: base32hex(sha256(claims)) over every JWT this crate signs.
 sha2.workspace = true
-# Comparing an agent's presented secret with the stored one.
-subtle.workspace = true
 # For `status::BUCKET` and `notices::STREAM` - the subjects a hive may
 # publish to are derived from these names, and every end that touches them
 # must agree on the same one. Deliberately WITHOUT the `kv` feature: this
 # crate derives subject strings, it never opens the bucket. `notices`
 # is name-only too (no `jetstream`/`kv` surface), same reason.
 swarm-queue-client = { workspace = true, features = ["notices"] }
-# The agent-token spelling the agent also uses, and the read of the stored
-# credential it is checked against.
+# The store reads: the callout keys, its own OIDC secret, and the agent
+# credentials `swarm-agent-verify` checks a presented token against.
 swarm-secret-client.workspace = true
+swarm-agent-verify.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true