An awaited refresh could resolve before its availability pass saved. Passes
ran concurrently, and only the most recently started pass could save its
result; a superseded pass returned without saving and refresh() still
resolved. At startup, the awaited refresh could lose to a fire-and-forget
refresh started by an extension provider registration, so initial model
selection read a snapshot without that provider and fell back to another
provider's default. A login also cancelled any full pass that was running.
Availability passes now run one at a time. A request made while a pass is
waiting to start joins it, so a caller always gets a pass that saw its
changes. Each pass has a 10 s timeout, so a hung auth check or credential
store no longer blocks the caller forever (#7301). A failed or timed-out
provider check keeps that provider's previous state and is reported in
getError().
The snapshot drops configuredProviders and all; hasConfiguredAuth reads
the auth map.
Refs #8810, #9884
