test(appsec): narrow to the django flush, per review DD_U55XLN

Reverts the flask app.py timeout change: its 10s already matched the caller's,
and cutting it to 5s reduced the flush budget for suites that do assert on
test-agent payloads, with no evidence it helped anything.

Keeps the django bound, rejustified. It is not the fix for the flake -- gevent
26.8.0 is, via gevent/gevent#2199 -- but an unbounded wait in a fixture teardown
holds the job to the suite timeout instead of failing one test, and a lost
gevent notification can only park an untimed wait forever.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: christophe-papazian

tests/appsec/app.py

@@ -337,8 +337,7 @@ def iast_code_injection_vulnerability():
 
 @app.route("/shutdown", methods=["GET"])
 def shutdown_view():
-    # Below the caller's 10s timeout, so the flush gives up before the request does.
-    tracer.shutdown(timeout=5)
+    tracer.shutdown(timeout=10)
     sys.exit(0)
 
 

tests/appsec/integrations/django_tests/django_app/urls.py

@@ -15,7 +15,8 @@
 
 def shutdown(request):
     # Endpoint used to flush traces to the agent when doing snapshots.
-    # Bounded: the default waits forever, and under gevent the flush can block the writer's hub.
+    # Bounded because the default never gives up, and gevent can park an untimed wait forever.
+    # Stays under the caller's 10s read timeout in appsec_utils.
     tracer.shutdown(timeout=5)
     return HttpResponse(status=200)