Harden SignalR authentication refresh

[BrennanConroy]

Summary

• prevent stale authentication refresh publications from rolling back hub user state
• synchronize the .NET client refresh timer across start, stop, close, manual refresh, and timer refresh, including safe short-lived-token scheduling
• separate replaceable refresh-transition policy from Long Polling send/delete connection ownership checks
• allow Blazor circuits to accept changed and anonymous identities and update circuit authentication state without reconnecting
• add focused regressions for refresh races, timer cleanup, disposal, overflow, ownership, and Blazor identity transitions

Tests

• SignalR .NET client authentication-refresh unit tests
• SignalR server authentication-refresh unit tests
• HTTP Connections authentication-refresh and ownership tests
• Components Server ComponentHubTest authentication-refresh tests
• Components E2E build
• ServerAuthTest.UpdatesAuthenticationStateWhenAuthenticationRefreshed
• git diff --check