[Fusion] Add the subscription authorization transport tests

[michaelstaib]

Ticket: hc-fork-2-fmr.2 (Subscription authorization transport tests)

Stacked on #51. This PR's diff is against mst/auth-subscription-lifetime. It has 9 commits and changes tests only, all under Fusion.AspNetCore.Tests.

It pins the subscription authorization of #51 over a real HTTP and WebSocket pipeline. Event sequences are snapshotted per element with MatchInlineSnapshots. Refusals are snapshotted with Markdown snapshots.

Server-sent events (SubscriptionAuthorizationSseTests)

• A denied subscribe is refused with 401 for anonymous, 403 for an authenticated principal, and 401 for a principal whose token has already expired. No source subscription is opened. The 401 refusals pin WWW-Authenticate: Bearer.
• A field denied at subscribe streams null plus an error on every event. A non-null field denial streams data: null plus an error.
• A deny flip renders from the next event. An allow flip applies only to a resubscribe.
• Token expiry ends the stream with complete alone.
• A mid-stream policy fault ends the stream with one payload carrying only the generic error, then complete. The response ends normally.
• The audit records that the subscribe decision stands when another verdict changes.

WebSocket (SubscriptionAuthorizationWebSocketTests)

• A denied subscribe, and a subscribe with an already expired token, are sent as a per-id graphql-ws Error. A second subscribe on the same socket still works.
• A deny flip sends per-event denials without ending the subscription. An allow flip applies only to a resubscribe.
• Token expiry closes the connection with 4401.
• A mid-stream policy fault is sent as a per-id Error, and the connection stays usable.
• connection_init is answered according to a socket session interceptor (4401, 4403 or ack).

Verified at 11242c2 (same tree as this head):

• dotnet build src/All.slnx: 0 errors.
• Fusion.AspNetCore.Tests on net10: 660 passed, 48 skipped.
• Fusion.Execution.Tests on net10: 1451 passed, 2 skipped.
• AspNetCore.Tests on net10: 771 passed, 2 skipped.
• The subscription authorization classes passed 3 runs in a row.

Not verified:

• Other target frameworks.

Open points:

• The SSE fault test is named ..._EndWithAnErrorEventThenComplete_..., but SSE has no error event here: the error arrives as a next event that carries only errors. A rename to ErrorResult is a one-line follow-up.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.