fix(cooldownqueue): eliminate "send on closed channel" panic on shutdown (#845)

* fix(cooldownqueue): eliminate "send on closed channel" panic on shutdown

The istio.io/pkg/cache TTL evicter goroutine races with CooldownQueue.Stop()
during SIGTERM, panicking with "send on closed channel". A select with a
<-done guard is insufficient: Go evaluates all select-case operands before
choosing, so if innerChan is already closed when the evicter callback fires,
the send-case evaluation panics before <-done can be taken.

Split the single channel into two owned by different actors: an intermediate
channel written only by the evicter callback (never closed, so it cannot
panic) and a consumer-facing result channel owned by a new relay goroutine
that closes it on the done signal, unblocking any for-range consumer. Stop()
now only closes done.

Also promote closed from a plain bool to atomic.Bool to remove a pre-existing
data race between Stop() and concurrent Enqueue()/Closed() callers.

Adds TestCooldownQueue_StopDuringEviction, which races Stop() against the
evicter 50 times and passes under -race.

Docs-exempt: internal concurrency bugfix, no API/config/behavioral change

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

* fix(cooldownqueue): address review feedback

- Correct the Stop() doc comment: the relay exits immediately on done, so
  pending evictions not yet forwarded may be dropped rather than drained.
- Keep each StopDuringEviction iteration alive past the cooldown window so
  the final iteration still exercises the post-Stop eviction callback path.

Docs-exempt: internal concurrency bugfix, no API/config/behavioral change
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>

---------

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>