fix: address code quality issues from review

- Make ConnectReceived thread-safe with Volatile.Read/Write (accessed from auth timeout task and command pipeline)
- Include authTimeoutTask in Task.WhenAny to propagate exceptions
- Clear nonce after authentication with CryptographicOperations.ZeroMemory
- Avoid closure allocation on publish permission cache hot path (method group)
- Update AuthTimeout default to 2s to match Go server

src/NATS.Server/NatsOptions.cs

@@ -26,5 +26,5 @@ public sealed class NatsOptions
     public string? NoAuthUser { get; set; }
 
     // Auth timing
-    public TimeSpan AuthTimeout { get; set; } = TimeSpan.FromSeconds(1);
+    public TimeSpan AuthTimeout { get; set; } = TimeSpan.FromSeconds(2);
 }