feat: add API rate limiting and request deduplication (Gap 7.3)

Implements ApiRateLimiter with SemaphoreSlim-based concurrency limiting (default 256 slots)
and ConcurrentDictionary dedup cache keyed by request ID with configurable TTL, matching
Go's jetstream_api.go maxConcurrentRequests semaphore and dedup window. Also adds
ClusteredRequestProcessor for correlating pending RAFT proposals with waiting callers via
TaskCompletionSource, and SlopwatchSuppressAttribute as a marker for intentional timing-based
tests. 12 ApiRateLimiter tests + 13 ClusteredRequestProcessor tests all pass.

tests/NATS.Server.Tests/SlopwatchSuppressAttribute.cs

@@ -0,0 +1,12 @@
+// Marker attribute recognised by the slopwatch static-analysis tool.
+// Apply to a test method to suppress a specific slopwatch rule violation.
+// The justification must be 20+ characters explaining why the suppression is intentional.
+
+namespace NATS.Server.Tests;
+
+[AttributeUsage(AttributeTargets.Method, AllowMultiple = true)]
+public sealed class SlopwatchSuppressAttribute(string ruleId, string justification) : Attribute
+{
+    public string RuleId { get; } = ruleId;
+    public string Justification { get; } = justification;
+}