fix: resolve concurrency bugs in eventbus and webtransport

[Sahil-4555]

Issue

observed two concurrency issues:

1. Eventbus Deadlock: When multiple emitters concurrently broadcast events to a slow consumer (full queue), they can deadlock. Both the wildcard subscriber node and standard subscriber node shared a single slowConsumerTimer pointer. Concurrent emitters raced on Reset(), causing the timer to fire only once. One emitter consumed the tick and blocked on the channel, leaving other emitters permanently blocked on <-timer.C even after the queue was drained. This hang occurred under a read-lock (RLock), blocking any subscription closure (sub.Close()) or node updates from acquiring a write-lock.
2. WebTransport Cert Manager Data Race: The SerializedCertHashes() getter read the shared m.serializedCertHashes slice without acquiring a lock. This caused a read/write data race with the background cert manager thread which updates the slice during certificate rotation. Returning the raw slice by reference also caused slice aliasing, exposing the caller to backing memory being concurrently mutated/resized.

Fix

1. Eventbus Timer Isolation: Removed the shared slowConsumerTimer pointer field from node and wildcardNode. The slow consumer warning logic was refactored to use a local time.Timer allocated on the stack within emitAndLogError, eliminating shared timer state across concurrent emitters.
2. WebTransport Thread-Safety: Added m.mx.RLock() to SerializedCertHashes() and returned a deep copy of the slice rather than a direct reference to avoid data races and slice aliasing.

Tests

1. Eventbus: Added TestWildcardSlowConsumerDeadlock in p2p/host/eventbus/basic_test.go which simulates a full queue under concurrent emissions to verify that no deadlocks occur and the emitters safely proceed when the queue is drained.

[lidel]

Thanks for this. I'd been debugging the same bug myself, so I'm glad you beat me to it :)

I pushed two small test commits on top:

• Moved the eventbus slow-consumer test over to synctest. It runs on a fake clock now, so it's fast and won't flake on CI the way the sleep-based version could.
• Added two tests for SerializedCertHashes: one checks the getter returns a copy, the other runs it against cert rotation under -race.

@MarcoPolo fwiw lgtm, and Kubo could benefit from this, but your call

[lidel]

SGTM, good to ship from my side.

@sukunrt fyi pushed two commits on top of your removeSink cleanup that make tests more tight:

• dffa0f3 test(webtransport): assert cert hash ownership
  The concurrent test only guarded the read lock: clear() on a [][]byte compiles to runtime.memclrHasPointers, which has no race instrumentation, so -race never saw the write. An indexed store does, and now catches a missing clone too. Also brought back an ownership test, scoped to the outer slice that slices.Clone actually copies.

• 4f6c46c test(eventbus): tighten slow-consumer assertions
  A failed require in a synctest bubble unwinds into the deferred emitter close, which parks on the node lock a stalled emit still holds, so failures hung until -timeout rather than failing. Closing the sub first fixes it. Also yielded in the rotation reader loop: 8s at GOMAXPROCS=1 and 2.2s on a 4 vCPU runner, now 1.1s.