Hold async admission requests and add RLS rate-limit example

[dio]

Header-only asynchronous admission could release a POST to the router when body data or trailers arrived before the callout decision. Hold both until admission completes, with regression coverage for forwarding and denial.

Add a reusable RLS v3 admission example with immutable policy snapshots, trusted descriptor sources, bounded Envoy-managed gRPC callouts, and explicit failure modes. Include a native-filter comparison and Fraser adoption boundaries. CI runs the new unit and Envoy e2e suites.

Validation:

• Root race tests, rate-limit race tests, and all example unit packages pass.
• Root Envoy e2e and rate-limit Envoy e2e pass after building their shared libraries.
• Format checks, vet, and lint across all four modules pass. Lint requires the repository-pinned Go 1.26.4; the locally installed Go 1.27.1 is incompatible with the pinned linter.
• A direct all-examples run could not complete unrelated e2e packages because their shared-library artifacts were missing or unavailable on the configured search path.

Local Envoy is pinned commit 0d6e3c60aa55 (1.39.0-dev). Envoy 1.38 qualification, Composer coexistence, and Fraser deployment are not established by these tests.