[MEDIUM] security(android): prevent prefetch from blocking indefinitely - #1140

Security impact

Android prefetchConfiguration blocks its native module queue on CountDownLatch.await(). Several normal paths never decrement that latch: discovery errors, invalid explicit configuration, and a cached issuer reached while the global isPrefetched flag is still false. A failing or malformed OAuth discovery response can therefore leave the promise and RNAppAuth native queue blocked indefinitely, preventing later authentication work until process restart.

Fix

• Remove the blocking latch and global prefetch flag.
• Resolve cached and explicit per-issuer configurations immediately.
• Resolve or reject directly from the asynchronous discovery callback.
• Return the native promise through the JavaScript wrapper so callers can await and handle completion.

This PR is limited to the prefetch availability defect. Concurrent interactive state and stale custom headers are submitted separately.

Breaking / observable changes

Android callers should await or catch prefetchConfiguration: it now settles when native prefetch completes and rejects on discovery/configuration failure. iOS remains a no-op.

Verification

• Android demo library compile: BUILD SUCCESSFUL
• Existing Jest suite: 3 suites / 81 tests pass
• Existing ESLint suite passes
• git diff --check passes

The repository has no Android native unit-test target; this focused native change is verified by the Android compilation and existing suites. Documentation, error-code typing, and a patch changeset are included. This supersedes only the prefetch portion of #1128.