snapshots/proxy: add optional default_timeout for proxy snapshotter calls - #14187

Problem

A proxy snapshotter runs in its own process and none of its 10 gRPC methods get a deadline unless the caller already set one. Snapshot GC calls Walk and then Remove per snapshot while holding the snapshotter-level lock in garbageCollect, so one wedged call blocks every later mutating call on that snapshotter and no new container using it can start. #14010 lists the other daemon paths with the same shape.

#13799 and #14026 each bounded one component. Per @fuweid in #14026, the bound belongs at the client instead, where it covers all 10 methods at once. @mikebrow agreed on 09/02. #13799 was reverted in #14119 ahead of 2.4 to go this route.

Fix

New default_timeout on [proxy_plugins]. When set, each proxy snapshotter call gets that deadline if the incoming context has none. A context that already carries its own deadline is left as it is, so this does not shorten anyone's request budget. Empty or unset keeps current behavior.

The option goes through a new NewSnapshotterWithOpts, so the exported NewSnapshotter signature is unchanged for package users.

Not in here

Total pass duration is still unbounded: N snapshots each finishing just under the limit still add up while garbageCollect holds the lock. That is @mikebrow's second point from the #14026 thread and it needs the lock itself reworked, so I left it out.

The content store proxy has the same gap, but it does not fit this shape. Writer outlives the call that created it, so a per-call deadline would cut an ingest that is still being written. It needs its own key and its own PR.

Walk gets one deadline for the whole stream, not one per received message, so time spent in callbacks counts against it and the next Recv fails once it expires. It cannot interrupt a callback that ignores its context. The GC callback only records keys, the call that wedges is the proxy RPC. Say the word if you would rather Walk and Cleanup were left out.

Tests

TestWithTimeout covers both guards. Drop the defaultTimeout <= 0 check and the disabled case goes red; drop the ctx.Deadline() check and the case that preserves a caller's 2h deadline goes red.

TestRemoveAppliesDefaultTimeout goes through NewSnapshotterWithOpts against a client that blocks until its context is done, so deleting the wrapper from Remove fails it in 5s with a clear message instead of hanging the package.

TestLoadPluginsRejectsMalformedProxyDefaultTimeout covers the config path, where a bad duration has to fail daemon startup rather than be ignored. Only the error path is exercised: LoadPlugins returns before it reaches the global plugin registry, which panics if a test registers the same id twice.

Refs #14010. Supersedes #14026.