feat(sdk): cache ListKeyAccessServers response during decryption

[eugenioenko]

Problem

Every call to loadTDF() triggers a ListKeyAccessServers RPC to the platform service to build a KAS allowlist. This happens in:

• TDF.loadTDF() in sdk/src/main/java/io/opentdf/platform/sdk/TDF.java:546

The result is never cached. There is no memoization and no deduplication of concurrent requests. If a caller decrypts 100 files, 100 identical RPCs are made to fetch the same KAS server list.

For comparison, KAS public keys are cached via KASKeyCache (sdk/src/main/java/io/opentdf/platform/sdk/KASKeyCache.java). The server list has no equivalent caching.

Callers can work around this by passing WithKasAllowlist() directly, but the default path always makes the network call.

Proposed Solution

Add a cache for the listKeyAccessServers() result. The cache should:

• Be keyed by platformUrl
• Deduplicate concurrent in-flight requests for the same platform URL
• Be scoped to the SDK instance so it does not leak across unrelated sessions
• Be invalidatable for callers that need a fresh list

This would reduce redundant network calls without sacrificing security, since the KAS registry changes infrequently relative to decrypt operations.

See also: opentdf/web-sdk#998 (same issue in the web SDK) and opentdf/platform#3897 (same issue in the Go SDK).