resolver(auth): avoid serializing unrelated auth callbacks

[crazy-max]

Follow-up to the narrow cancellation fix in #6641. That first fix only addressed the manual cancellation case and that more fixes were likely needed for the broader discussion.

That broader discussion is in #6633, where the report and follow-up comments point at unrelated auth and resolver work being stalled behind one slow or stuck auth path. This change hopefully addresses that remaining resolver-side serialization problem without taking the larger refactors proposed in the original patch stack.

This change narrows the resolver auth handler locking so one slow auth callback does not block unrelated auth work for the same resolver namespace.

The fetchers map synchronization now lives inside authHandlerNS helper methods instead of wrapping the whole Authorize and AddResponses flows. The resolver still snapshots and reuses cached auth fetchers the same way, but session callbacks such as Credentials, VerifyTokenAuthority, and token fetch work no longer run while muHandlers is held. I also added resolver tests that block one host in the real session auth RPC path and verify that an unrelated host can still complete its own AddResponses or Authorize flow.

[tonistiigi]

ptal #6649

[crazy-max]

ptal #6649

Yeah if the root issue is the wedged session tunnel path, then your changes make more sense.