fix(shared): clean up zero-count entries in ConnectionLimiter to prevent memory leak

[chill-czar]

Closes #3448

Summary

• Automatically evict zero-count key entries from ConnectionLimiter map when all active connections for a key are released.
• Add atomic eviction callback RemoveCb in Release(key) within packages/shared/pkg/connlimit/limiter.go.
• Add unit test coverage in packages/shared/pkg/connlimit/limiter_test.go asserting zero-count map key cleanup and fresh re-acquisition behavior.

Why

ConnectionLimiter in packages/shared/pkg/connlimit tracks per-key concurrent connections in an smap.Map[*atomic.Int64]. Previously, Release(key) decremented the counter to 0 via CompareAndSwap, but never removed the key entry from the underlying concurrent map.

For generic HTTP proxy connection limiting and client-IP rate limiting where there is no sandbox termination event to invoke Remove(key) manually, every historic unique key remained in memory with count 0. On long-running edge proxy services (client-proxy and orchestrator/pkg/tcpfirewall), this resulted in steady heap memory accumulation over time.

smap.RemoveCb checks v.Load() == 0 under smap's internal shard lock, guaranteeing zero-count keys are safely removed without race conditions against concurrent TryAcquire calls.

Test Plan

• Unit tests pass: go test -race -v ./packages/shared/pkg/connlimit/...
• Verified zero-count key eviction via limiter.connections.Count(). assertions
• Verified concurrent acquire/release under Go race detector (-race)
• Formatted code cleanly: go fmt ./...
• No regressions across packages/shared test suite

/cc @jakubno @dobrac @ValentaTomas @arkamar @tvi

[chill-czar]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 119faf42c5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chill-czar]

Hi @jakubno @ben-fornefeld , would appreciate a review on this when you have a moment.

Quick summary: Addresses a memory leak in ConnectionLimiter where released zero-count connection keys remained in the map. We added atomic RemoveCb eviction upon Release() to safely clean up zero-count keys without racing concurrent TryAcquire() calls. Unit tests and race-detector checks are passing. Thanks!