[fix][proxy] Close client connection immediately when credentials expire and forwardAuthorizationCredentials is disabled

[nodece]

Fixes #25071

Motivation

This pull request enhances the authentication credential refresh logic in the Pulsar Proxy and adds comprehensive tests to ensure correct behavior when client credentials expire, especially when authorization credentials are not forwarded to the broker. The changes improve reliability and correctness in handling authentication expiration and provide a robust test for the new logic.

Modifications

Proxy authentication refresh and expiration logic:

• Refactored the authentication credential refresh logic in ProxyConnection.java by introducing the startAuthRefreshTaskIfNotStarted() helper, ensuring the refresh task is only scheduled when needed and in the correct states. The refresh logic now checks if the connection is in an authenticated state and properly handles cases where credentials expire and authorization credentials are not forwarded (forwardAuthorizationCredentials=false). [1] [2] [3] [4]

Test suite improvements:

• Added a new test testClientDisconnectWhenCredentialsExpireWithoutForwardAuth in ProxyAuthenticationTest.java to verify that the client is disconnected when credentials expire and the proxy is not forwarding authorization credentials. The test uses Awaitility to assert proper disconnection behavior.
• Updated and expanded the mock authentication provider and state in the test suite to simulate credential expiration and support the new authentication flow, including parsing and checking expiration within the mock state. [1] [2]

Minor test utility and import updates:

• Added necessary imports and updated HTTP header handling in the test authentication data provider for improved correctness and clarity. [1] [2] [3]

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[lhotari]

LGTM

[lhotari]

/pulsarbot rerun-failure-checks