[MEDIUM] security(android): prevent prefetch from blocking indefinitely

[OskarEichler]

Security impact

Android prefetchConfiguration blocks its native module queue on CountDownLatch.await(). Several normal paths never decrement that latch: discovery errors, invalid explicit configuration, and a cached issuer reached while the global isPrefetched flag is still false. A failing or malformed OAuth discovery response can therefore leave the promise and RNAppAuth native queue blocked indefinitely, preventing later authentication work until process restart.

Fix

• Remove the blocking latch and global prefetch flag.
• Resolve cached and explicit per-issuer configurations immediately.
• Resolve or reject directly from the asynchronous discovery callback.
• Return the native promise through the JavaScript wrapper so callers can await and handle completion.

This PR is limited to the prefetch availability defect. Concurrent interactive state and stale custom headers are submitted separately.

Breaking / observable changes

Android callers should await or catch prefetchConfiguration: it now settles when native prefetch completes and rejects on discovery/configuration failure. iOS remains a no-op.

Verification

• Android demo library compile: BUILD SUCCESSFUL
• Existing Jest suite: 3 suites / 81 tests pass
• Existing ESLint suite passes
• git diff --check passes

The repository has no Android native unit-test target; this focused native change is verified by the Android compilation and existing suites. Documentation, error-code typing, and a patch changeset are included. This supersedes only the prefetch portion of #1128.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: de49c49

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
react-native-app-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR