Move Kerberos proxy auth off the Netty event loop

[dagnir]

Generating a SPNEGO token performs a JAAS login and may make a blocking TGS request to the KDC. That ran on the Netty event loop during proxy tunnel setup, so a slow or unreachable KDC stalled every other channel assigned to that loop, and SDK timeouts could not unpark the thread.

ProxyAuthGenerator now returns a CompletableFuture, so the contract states that generating params may be slow and must not complete on the caller's thread. Basic auth completes inline and stays on the existing synchronous path; the handler only hops threads when the future is not already done.

AwaitCloseChannelPoolMap creates the executor the Negotiate generator runs on, and shuts it down when it closes, so the resource is created and released in the same place. It is a single daemon thread, created only when NEGOTIATE is configured: the goal is to keep blocking work off the event loops, not to parallelize it. The generator itself is resolved once per client rather than once per remote host.

Motivation and Context

Modifications

Testing

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have read the CONTRIBUTING document
• Local run of mvn install succeeds
• My code follows the code style of this project
• My change requires a change to the Javadoc documentation
• I have updated the Javadoc documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
• My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

• I confirm that this pull request can be released under the Apache 2 license