fix(workloadapi): reject watches after client close

[maxlambrecht]

What

• Reject watchX509Context, watchX509Bundles, and watchJwtBundles calls after DefaultWorkloadApiClient.close().
• Snapshot and clear registered cancellable contexts while synchronized on the context list before closing them.
• Add focused tests for watch-after-close behavior and synchronized shutdown snapshotting.

Why

The client previously allowed new watch registrations after shutdown and iterated a synchronized list without holding the list monitor during close. This could leave lifecycle behavior inconsistent and make shutdown iteration unsafe.

How tested

• ./gradlew :java-spiffe-core:test --tests 'io.spiffe.workloadapi.*'