feat(pdp): add an opt-in bounded decision cache

[araujof]

Description

Add an optional cache around PDP evaluation for policies whose decision can be reused safely. This caches decisions, not the existing CEL and OPA compiled programs. It remains off by default and should land after the benchmark suite in #19 provides a baseline.

The key must represent the PDP dialect, call arguments, and complete attribute bag without retaining readable request data. Entries expire after an operator-configured TTL and are invalidated when PPE configuration changes. PDP errors are never cached. The documentation must state that an external PDP policy can change independently of PPE and may remain stale until the TTL expires.

Acceptance criteria

• PDP configuration supports an optional cache with a positive TTL and a maximum entry count; omission disables it.
• Cache keys use a deterministic digest of the dialect, call arguments, and complete attribute bag, independent of map iteration order.
• Both Allow and Deny decisions may be reused; dispatch errors and timeouts are never cached.
• Expired entries are never returned, the entry bound is never exceeded, and eviction behavior is deterministic.
• A PPE configuration generation change prevents decisions from the previous generation being reused.
• Concurrent evaluation is race-free and returns the same decision as an uncached evaluation.
• Hit, miss, expiry, and eviction behavior is observable without exposing key material or policy attributes.
• Tests cover TTL expiry, capacity, reload invalidation, Allow, Deny, errors, and concurrent access for each builtin PDP.
• Benchmarks based on perf(bench): add a benchmark suite #19 record the hit and miss costs and show whether enabling the cache is worthwhile.