## Why
Authorization can change during token renewal before a revocation watcher runs. Requests must check that their authority is still current before dispatch.
## What changed
- Let `EmaRequestAuthority` accept a cancellation token and a synchronous authority check, revoking itself when the check fails.
- Recheck authority after authentication and after receiving HTTP responses for both regular and streaming requests.
- Add `CloudConfigBundleBinding::invalidated()` to wait until a captured policy binding is no longer current.
## Testing
Update tests to cover ownership changing during token renewal without explicit revocation, preventing HTTP dispatch, and parent-token cancellation ending an existing response stream.
GitOrigin-RevId: a142d6bcd0cd7a3d2e9d438a45dc640d93235656
jif
4e7b9e285b