fix: address code quality issues from review

- Make ConnectReceived thread-safe with Volatile.Read/Write (accessed from auth timeout task and command pipeline)
- Include authTimeoutTask in Task.WhenAny to propagate exceptions
- Clear nonce after authentication with CryptographicOperations.ZeroMemory
- Avoid closure allocation on publish permission cache hot path (method group)
- Update AuthTimeout default to 2s to match Go server

src/NATS.Server/Auth/ClientPermissions.cs

@@ -34,7 +34,7 @@ public sealed class ClientPermissions : IDisposable
         if (_publish == null)
             return true;
 
-        return _pubCache.GetOrAdd(subject, s => _publish.IsAllowed(s));
+        return _pubCache.GetOrAdd(subject, _publish.IsAllowed);
     }
 
     public bool IsSubscribeAllowed(string subject, string? queue = null)