feat(PLA-8129): runtime Redis-SET allowlist for the decay backend

[ysolomon-plat]

What

Adds the PLA-8129 runtime allowlist to cache_impl.go: an operator SADDs a
value to a Redis SET (allowlist:rl_ip / allowlist:rl_ua / allowlist:rl_subject)
and it's exempted from rate limiting on the very next request — no deploy,
no EnvoyFilter apply. Replaces the compiled-in Lua tables that made a config
change a deploy.

Matches ratelimiting.lua's existing, asymmetric exemption rules
(ip_rate_limit_with_pooling / user_agent_rate_limit_with_pooling /
auth_rate_limit_with_pooling, :204-253):

• an allowlisted IP exempts rl_ip, rl_ua AND rl_subject together, for the whole request
• an allowlisted user-agent or user-id exempts only its own bucket
• client_id is never exempted by any allowlist

Why this PR exists now

This code has been running live in Depop's dev-default cluster since
2026-08-21, deployed via a Kubernetes ConfigMap. It was never pushed to this
repo, never opened as a PR, never reviewed, and had zero tests. Confirmed
live via ratelimit-fork debug logs on 2026-09-03 as part of proving the
PLA-8126 gRPC authorizer → PLA-8128 rate limiter join actually works. This
PR is that catch-up: real code review, on the actual running logic, plus the
test coverage it should have had from the start.

Tests

8 new tests in test/redis_decay/allowlist_test.go, matching the style of
the existing cache_impl_test.go suite:

• IP allowlist exempts its own bucket, and separately, the cross-bucket
  exemption (IP allowlisting also exempts UA/subject descriptors elsewhere
  in the same request)
• UA and subject allowlists each exempt only their own bucket
• client_id is never exempted, even when IP is allowlisted
• A non-allowlisted value is rate limited normally (allowlist machinery is a
  no-op for the common case)
• No allowlists configured at all behaves identically to the pre-allowlist
  implementation
• A Redis failure during the allowlist membership check panics as
  redis.RedisError, same as a decay-pipeline failure — the service layer's
  failure-mode policy must not be bypassed just because the failure
  happened in this new phase

All 18 tests in the package pass (10 pre-existing + 8 new):

go test ./test/redis_decay/... -v
ok  	github.com/envoyproxy/ratelimit/test/redis_decay	1.031s

go build ./... and go vet ./src/redis_decay/... are both clean.