Wire A32 circuit breaking into xDS channels

[mingley]

Summary

This PR connects gRFC A32 circuit breaking to the xDS request path in tonic-xds. The circuit breaker works like a shared pool of slots: before an endpoint attempt begins, the channel reserves one slot for the selected {cluster, EDS service}. The CDS max_requests value sets the pool size, with the A32 default of 1024 when the field is omitted. If no slot is available, the client returns a local, non-retryable gRPC UNAVAILABLE response without contacting an endpoint.

• Circuit-breaking limits follow live CDS updates. A permit stays reserved until the response body completes, errors, or is dropped, so the process-wide counter represents active RPC attempts across channels.
• Local circuit-breaker responses are identified as pre-endpoint outcomes. Retry handling does not retry them, and outlier detection does not count them as endpoint failures.
• The xDS cache preserves resource removals with generation and revision tracking. Removing CDS or EDS state clears obsolete breaker state and endpoints; re-added endpoints wait for a connector from the matching generation instead of reusing stale limits, connectors, or endpoint state.

Testing Done

• cargo fmt --all -- --check — completed successfully.
• cargo test -p tonic-xds client::loadbalance::loadbalancer::tests::circuit_breaker_drops_are_not_endpoint_outlier_outcomes -- --exact — 1 passed, 0 failed, 376 filtered out.
• ci

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mingley / name: Michael Ingley (4609832, 7505002)