Bound DTLS handshakes with a monotonic deadline

[Jason-Morcos]

Problem

connect() currently starts its 12-second timeout after context and socket setup, measures it with wall time, and can overrun it by a final two-second receive. Callers also cannot request a shorter connection attempt.

Changes

• Add keyword-only connect(timeout=...), retaining the 12-second default.
• Validate timeout values as positive, finite numbers.
• Start one monotonic deadline before authentication context and socket setup.
• Cap the initial socket timeout, each receive poll, and each retry sleep to the remaining budget.
• Reject a handshake reported successful at or after the deadline.
• Preserve the existing two-second retry cadence except for the final shortened poll.
• Leave reader timeouts and post-connect behavior unchanged.

Expiry continues to use the existing SessionTimeoutError.

Validation

• 192 tests with current dependencies.
• 192 tests on Python 3.11 with pyOpenSSL 23.1.
• All 1,070 LocalThings tests against this checkout.
• Focused Ruff, compile, share-safety, distribution-content checks, and isolated wheel/sdist imports.

The deadline tests use a deterministic monotonic clock and cover malformed values, setup time, shortened final polls, success at and after expiry, the default timeout, and successful session state.

Stack

Depends on #33. Until #33 merges, GitHub includes its certificate-profile commit in this PR's comparison; the new commit for this slice is eae1aef.

Planned follow-ups remain separate: connect cancellation/quiesce/abort, then graceful close and session generations.