fix: address code quality issues from review

- Make ConnectReceived thread-safe with Volatile.Read/Write (accessed from auth timeout task and command pipeline)
- Include authTimeoutTask in Task.WhenAny to propagate exceptions
- Clear nonce after authentication with CryptographicOperations.ZeroMemory
- Avoid closure allocation on publish permission cache hot path (method group)
- Update AuthTimeout default to 2s to match Go server

tests/NATS.Server.Tests/AuthConfigTests.cs

@@ -16,6 +16,6 @@ public class AuthConfigTests
         opts.Users.ShouldBeNull();
         opts.NKeys.ShouldBeNull();
         opts.NoAuthUser.ShouldBeNull();
-        opts.AuthTimeout.ShouldBe(TimeSpan.FromSeconds(1));
+        opts.AuthTimeout.ShouldBe(TimeSpan.FromSeconds(2));
     }
 }