StartCommand: keep waiting past the default start timeout unless a start exception was recorded

[jbonofre]

Summary

• Fixes StartCommand exits with no logged error after 10-minute default timeout when a slave broker legitimately waits for the lock under startAsync=true #2552: a broker started via ./activemq start with startAsync=true, running as a slave, disappeared after roughly 10 minutes with nothing logged.
• BrokerService.DEFAULT_START_TIMEOUT is 10 minutes, and StartCommand called broker.waitUntilStarted() with that timeout, throwing (and exiting the process) whenever it returned false. Before startAsync existed this was harmless, since start() itself blocked until the broker became master. With startAsync=true, start() returns immediately, and a slave can legitimately wait on the lock far longer than 10 minutes.
• StartCommand now loops on waitUntilStarted(), only throwing/exiting once broker.getStartException() is actually non-null. This can't spin indefinitely: BrokerService.stop() always records a start exception (BrokerStoppedException) before it ever marks the broker as stopped, so a real stop or startup failure still surfaces immediately.

Test plan

• mvn -pl activemq-console -am compile succeeds
• Manual verification: start a slave broker with startAsync=true and confirm the process stays alive past 10 minutes while waiting on the lock, and exits promptly with a logged error on an actual startup failure

Fixes #2552

[cshannon]

Just like my comment on the other PR, we should probably do an broker.isSlave() check here. The exception should be set, but in case something gets broken in the future this would add an extra check just to ensure we always fail for a primary/active broker just like today if it returns false.

Maybe:

while (!broker.waitUntilStarted()) {
    if (broker.getStartException() != null || !broker.isSlave()) {
        throw new Exception(broker.getStartException());  
    }
}