feat(server): bound auto protocol detection with read_version_timeout

[Aditya-9-6]

Problem

Closes hyperium/hyper#3962
Closes hyperium/hyper#3756

The auto server builder (hyper_util::server::conn::auto::Builder) reads the initial bytes of an incoming connection to distinguish between HTTP/1 and HTTP/2 before handing the connection off to the corresponding protocol state machine.

Until this detection read completes, per-protocol timeout settings — including http1::Builder::header_read_timeout — are not active. As a result, a peer that connects but never transmits any data remains in the version sniffing loop indefinitely, presenting a Slowloris DoS vector on auto servers.

Solution

This PR adds read_version_timeout(timer, duration) to bound the initial protocol-detection phase:

• Eagerly arms a deadline when serving begins (Timer::sleep).
• Polling the timeout future inside ReadVersion::poll registers the timer's waker, ensuring idle connections are promptly woken upon expiry.
• On timeout expiry, the connection terminates with an io::ErrorKind::TimedOut error.
• Wraps the timer in ReadVersionTimer(Arc<dyn Timer + Send + Sync>) to preserve Clone and Debug implementations on Builder<E> and Connection::into_owned().
• Protects both serve_connection and serve_connection_with_upgrades.
• Provides convenience forwarders on Http1Builder and Http2Builder.
• Zero overhead and no-op when http1_only or http2_only is configured (as those bypass ReadVersion).

Verification

• Added integration test read_version_timeout_closes_idle_connection: Verifies that an idle peer connecting with 0 data is dropped promptly with io::ErrorKind::TimedOut.
• Added integration test read_version_timeout_allows_timely_request: Verifies that timely incoming requests succeed normally.
• All 12 unit and integration tests pass under cargo test --features full.
• Code formatting and lints verified with cargo fmt --check and cargo clippy.