fix: abort timed-out OCSP requests

[TorinAsakura]

Fixes #455.

Abort OCSP requests when the 30-second deadline expires, including requests that have received headers but are still waiting for the body. Previously, a body timeout could leave the socket open and return a non-retryable verification failure.

Use one AbortController and timer for the request and body read. Clear the timer and abort the request in finally, including HTTP error responses. A deadline abort returns RETRYABLE_VERIFICATION_FAILURE. Other body-read and OCSP validation errors keep their existing classification.

Two regression scenarios use a local HTTP server: one response never sends headers; the other sends a partial body and stops. Both verify that the SDK returns a retryable failure and closes the connection when the deadline expires.

Validation:

• yarn build
• 22 tests passed in jws_verification.test.ts; the existing live OCSP test was excluded
• against the original upstream implementation, the incomplete-body scenario fails with a non-retryable body timeout; the headers scenario passes
• git diff --check