Remove per-bind global lock contention in AuthenticatedUsers

[vharseko]

Summary

Removes a global lock that every LDAP BIND (and unbind) takes on the hot
path, which serialized authentications under concurrency. Replaces the
AuthenticatedUsers map (a DITCacheMap guarded by a single
ReentrantReadWriteLock) with a ConcurrentHashMap, so registering /
deregistering a connection no longer contends on one global write lock.

Test PR vs Release: https://github.com/vharseko/OpenDJ/actions/runs/28219689094

Problem

Every successful bind registers the connection in the server-wide
AuthenticatedUsers map via ClientConnection.setAuthenticationInfo()
(put on bind, remove on unbind / re-bind). The map was backed by a
DITCacheMap protected by a single ReentrantReadWriteLock, so put() and
remove() took one global write lock on the hot path of every
authentication — even though connections authenticating as different users
never actually conflict.

Under load this serializes binds. With 200 connections binding as different
users, jstack sampling showed roughly half of the worker threads parked
acquiring that lock:

at java.util.concurrent.locks.ReentrantReadWriteLock$WriteLock.lock
at org.opends.server.core.AuthenticatedUsers.put / .remove
at org.opends.server.api.ClientConnection.setAuthenticationInfo
at org.opends.server.core.BindOperationBasis.run

Change

• AuthenticatedUsers now uses
  ConcurrentHashMap<DN, CopyOnWriteArraySet<ClientConnection>>. put /
  remove / get are lock-free at the map level (bin-granularity locking via
  computeIfAbsent / computeIfPresent); binds for different users run in
  parallel.
• The post-response handlers that keep authenticated connections in sync with
  changes to their entries are updated:
  • modify → exact-DN lookup, O(1) (a modify never affects descendants,
    so no subtree scan is needed);
  • delete / modify-DN → keep subtree semantics via a single key-set
    pass (removeSubtree) with an isEmpty() fast-exit; the redundant
    pre-check operationDoesNotTargetAuthenticatedUser is removed.
• Public behaviour and the get() return type (CopyOnWriteArraySet) are
  unchanged.

Benchmark

Packaged server, je backend, 5000 users (uid=user.N, userPassword
hashed {SSHA}), 200 client threads on persistent connections each
re-binding as a random distinct user, JDK 11.

metric	before (global lock)	after (ConcurrentHashMap)
throughput	~18,400 binds/s	~23,000 binds/s (+~25%)
latency mean	11.0 ms	8.5 ms
latency p50	9.5 ms	6.5 ms
latency p90	16.1 ms	12 ms
workers parked on the lock (jstack)	~half	0

At moderate (non-saturating) concurrency the win is larger and tail latency
also improves; at 200-thread saturation p99 is GC-bound at the higher
operating point (no longer the bind bookkeeping).

Testing

• Adds BindLatencyBenchmarkTestCase — an opt-in concurrent BIND
  latency/throughput benchmark (N threads, distinct users, persistent
  connections). Disabled by default; it only runs with -Dbind.bench=true,
  so the normal test suite is unaffected. Example:

  mvn -P precommit -pl opendj-server-legacy verify \
      -Dit.test=BindLatencyBenchmarkTestCase -DfailIfNoTests=false \
      -Dbind.bench=true -Dbind.bench.threads=200 \
      -Dbind.bench.durationSeconds=120 -Dbind.bench.label=after
  

• Existing bind / AuthenticatedUsers regression tests continue to pass;
  main and test sources compile (JDK 11, target 11).

Files

• opendj-server-legacy/src/main/java/org/opends/server/core/AuthenticatedUsers.java
• opendj-server-legacy/src/test/java/org/opends/server/core/BindLatencyBenchmarkTestCase.java