feat: KSM-881 throttle retry with exponential backoff

[mgallego-keeper]

Summary

Implements throttle retry with exponential backoff for the Go SDK (epic KSM-876, task KSM-881). The Keeper backend throttles with HTTP 403 {"error":"throttled"}; previously the SDK returned a *KeeperHTTPError on the first throttle. Now PostQuery retries transparently, so every SecretsManager operation (GetSecrets, CreateSecret, UpdateSecret, …) gains throttle resilience with no caller changes.

What changed

• core/core.go — in the PostQuery loop, detect throttle responses before HandleHttpError and retry with exponential backoff + jitter; return ErrThrottled (wrapped) once retries are exhausted. Adds parseThrottle (detection / retry_after) and throttleDelay (backoff + jitter), plus a throttleJitter seam for deterministic tests.
• core/errors.go — new exported sentinel ErrThrottled (check with errors.Is(err, ksm.ErrThrottled)).
• core/keeper_globals.go — maxThrottleRetries = 5, baseThrottleDelaySec = 11 (1s margin over the backend's 10s memcached TTL). No new public config.
• core/payload.go — optional Context.Sleep func(time.Duration) field (defaults to time.Sleep); a no-real-sleep test seam mirroring the existing Context.Transport, preserved across PrepareContext rebuilds.
• CHANGELOG.md — entry under ## Unreleased. No version bump.

Algorithm

Delays 11s, 22s, 44s, 88s, 176s (each ±25% jitter) → ~341s worst case over 5 retries. A retry_after in the response body takes precedence when present. HandleHttpError is untouched, so key-rotation retry is unaffected.

Tests

• core/throttle_test.go (unit): throttleDelay exponential sequence, retry_after precedence, jitter bounds (pinned via the throttleJitter seam); parseThrottle table (throttled / result_code / other error / non-JSON / empty / non-numeric / negative retry_after).
• test/throttle_test.go (end-to-end via GetSecrets, sleeps recorded through Context.Sleep): retry-then-success, multi-throttle delay bounds, exhaustion → errors.Is(ErrThrottled), retry_after honored, throttle + key-rotation compose, non-throttle 403 / non-JSON 502 not retried.
• TestHTTPErrorErrorsAs switched to a non-throttle error code (throttling is now retried).

$ cd core && go test ./... && go vet ./...   # ok
$ cd test && go test ./...                    # ok

Jira: KSM-881 · mirrors the Python implementation (Keeper-Security/secrets-manager#1031).

---

Addendum (jitter hardening, KSM-1030)

Jitter corrected from symmetric ±25% to one-sided 0–+25%:

• Bug: floor × (1 - 0.25) = 8.25s — a retry could fire before the backend's 10s memcached window expires, wasting the attempt and resetting the throttle counter.
• Fix: throttleJitter now returns [0, 0.25) so the delay is always ≥ the floor.
• Added maxThrottleDelaySec = 176 to keeper_globals.go and applied as a cap in throttleDelay so a server-supplied retryAfter above 176s is clamped rather than honored blindly.