[key-server] Apply the configured RPC timeout to the fullnode gRPC client

[tamashi095]

Fixes #624

[key-server] Apply the configured RPC timeout to the fullnode gRPC client

Summary

RpcConfig.timeout (default 60s) is exposed to operators in KeyServerOptions
and documented as "Timeout for individual RPC requests", but it was never
applied anywhere:

• Server::new (server.rs) passed only rpc_config.retry_config into
  SuiRpcClient::new, and
• build_grpc_client (sui_rpc_client.rs) constructed the tonic client with
  no per-request timeout.

As a result, every fullnode RPC the key server makes — package resolution,
MVR lookup, address-alias check, policy simulation, zkLogin signature
verification — could hang indefinitely.

This change threads the configured timeout into the gRPC client via
SuiGrpcClient::with_response_headers_timeout, for both the key server and
the aggregator. Expiry surfaces as DeadlineExceeded, which the existing
retry layer already handles, so behavior on a healthy fullnode is unchanged.

Why it matters

The key server performs several fullnode RPCs per /v1/fetch_key request
before the certificate signature is verified, and has no in-process
concurrency limit. With a stalled or slow fullnode (or an exhausted fullnode
rate quota — which unauthenticated traffic itself can cause via these
pre-signature RPCs), every inbound request pins a task, a connection, and
memory for an unbounded time. Under modest request volume this grows
linearly until the process exhausts file descriptors or memory and needs a
restart.

With this fix, each RPC is bounded by rpc_config.timeout (× retry attempts

• backoff), so requests fail cleanly and resource usage stays bounded during
  fullnode incidents.

Reproduced locally with a stub fullnode that answers GetEpoch but hangs all
other RPCs: at 100 unauthenticated requests/second the stock server
accumulated ~6,000 in-flight requests / open FDs in 60s with linearly growing
RSS and never answered a single request; with the timeout applied (set to 2s
for the test) every request failed within ~7s and in-flight stayed flat.

Test plan

• Added sui_rpc_client::tests::test_build_grpc_client_applies_timeout: spins
  up a gRPC LedgerService that never responds and asserts the call fails
  with DeadlineExceeded shortly after the configured timeout instead of
  hanging forever.
• Existing callers updated to pass a timeout (options.rpc_config.timeout in
  the key server and aggregator; a fixed 30s in test helpers).

Notes

• Follow-ups worth considering (kept out of scope to keep this small): verify
  the certificate signature before issuing outbound RPCs, negative-cache MVR
  resolution failures, and add a global in-flight request limit.

[joyqvq]

small edits, lgtm, thanks for the contribution