Native UDP: hardening fixes (slot leak, transient errors, rotation, visitor unregister)

[ssharkkky]

Summary

Hardening fixes for the native UDP path on top of codex/native-udp-foundation.
Four small, self-contained changes addressing correctness and availability
issues found while reviewing the SOCKS5 UDP ASSOCIATE → CONNECT-UDP over H3
datagram flow. Each is an independent green-to-green commit.

Caveat: these were not built locally — this is a Chromium tree and a
full build was not run in this environment. The changes are code-review-only;
please build + run the naive UDP tests before merging.

What's fixed

1. Target-slot leak on first-datagram admission drop (naive_connect_udp_datagram_backend.cc)
   Send() inserted a new TargetEntry into targets_ before the
   association-level admission checks. When those checks rejected the datagram
   that created the target, Send() returned OK and left a permanent
   kConnecting entry with an empty queue that no timer reaps — leaking one of
   the 32 target slots for the association's lifetime. A client bursting many
   distinct destinations under queue pressure could exhaust the target table.
   Fix: erase the freshly created entry on the admission-drop path.

2. Transient UDP relay error tears down the whole association (socks5_udp_association.cc)
   HandleRelayRead() / OnRelayWriteComplete() called Finish() on any
   negative result, killing the control TCP connection and every active tunnel.
   A single per-packet condition — most commonly Windows surfacing a prior ICMP
   "port unreachable" as ERR_CONNECTION_RESET on the next recv/send, also
   ERR_MSG_TOO_BIG / ERR_ADDRESS_UNREACHABLE — would take down traffic to
   all unrelated destinations sharing the association. Fix: classify these as
   recoverable, drop the affected datagram, keep pumping.

3. UDP associations never rotate at tunnel_timeout_ (socks5_udp_association.{h,cc}, naive_proxy.cc)
   CleanUpIdleConnections() rotates TCP tunnels on both idle_timeout_ and a
   tunnel_timeout_ max-lifetime bound, but UDP associations were only aged by
   idle_timeout_. A steadily-used association never rotated. Fix: expose
   creation_time() and apply the same idle || age test used for TCP tunnels.

4. Asymmetric H3 datagram-visitor unregister on stream close (quic_proxy_datagram_client_socket.cc)
   Close() guards UnregisterHttp3DatagramVisitor() behind
   datagram_visitor_registered_, but OnStreamClosed() cleared the flag
   without unregistering. It's a no-op today (the stream is already closed on
   that path), but the asymmetry is fragile under future refactors. Fix: make
   OnStreamClosed() perform the same guarded unregister. Defensive only.

Not addressed here (follow-ups)

Deliberately left out of this PR because they involve configuration surface or
authorization-semantics decisions the branch author should own:

• UDP-ASSOCIATE capability/disable path in NaiveProxy::CanUseNativeUdp() —
  no server-capability check or explicit disable flag, so a mismatch can silently
  black-hole UDP. Needs a config/CLI decision.
• Relay socket attached to the global NetLog in BindUdpRelay() — latent
  under the shipped kDefault capture mode, but at kEverything the SOCKS5
  datagram destination + payload would be captured. A correct fix needs a
  non-capturing NetLog path and touches NetLog semantics.
• IsAuthorizedClient() wildcard-port latching — when the client requested
  DST port 0, the first datagram from any source port on the control-peer IP
  latches client_endpoint_. Tightening this is an authorization-semantics
  change.

Testing

Not built or run locally. Review-only. Suggest building the naive target and
running the SOCKS5 UDP / CONNECT-UDP unit tests before merge.