Rebuild deny filters during inherited permission refresh (#8622)

## Context

NATS checks subscription permissions when subscriptions are created and
maintains a delivery-time deny filter for active subscriptions. The
delivery-time check prevents messages matching subject-level deny rules
from reaching a client, including while permission updates are being
processed.

Clients inheriting account permissions are refreshed when those
permissions change. Existing subscriptions must be revalidated against
the updated policy, but message delivery can continue concurrently.

  ## Regression

The permission rebuild cleared the client’s delivery-time deny filter
before processing existing subscriptions and released the client lock
while that filter was empty. This created a temporary fail-open window:

1. A client has an active subscription covered by a deny rule.
2. Its inherited account permissions are refreshed.
3. The delivery-time deny filter is temporarily cleared.
4. A concurrent message matching the unchanged deny rule can be
delivered before the filter is rebuilt.

This occurred even when the relevant deny rule had not changed.

## Fix
 
- Revalidate active subscriptions and rebuild the delivery-time deny
filter while holding the permission-update lock.

- Make the refreshed deny filter visible atomically when permission
processing completes.

- Retain the follow-up processing that removes subscriptions no longer
authorized.

This keeps unchanged deny rules continuously enforced without changing
the existing subscription-removal behavior.

## Testing

- Focused inherited-permission refresh tests covering delivery-time deny
rules.
- Three concurrent stress matrices exercising the refresh/delivery race.
- All matrices completed with zero unauthorized deliveries.