fix(pool): bound the entire connection return operation

[KimSoungRyoul]

Hi @abonander, I'm using SQLx 0.9.0 and have encountered persistent connection pool timeouts in production. Restarting the affected instance restored service, which led me to investigate #4349.

A local PostgreSQL regression test reproduces the permit leak in #4349: when a connection stops responding, return_to_pool() can wait indefinitely while holding its pool permit. Repeated failures exhaust the pool, and subsequent acquisitions time out because the permits are never released.

Following the review on #4350, this bounds the entire return operation with one five-second timeout, including callbacks, ping, and shutdown. On expiry, the return future is dropped, discarding the connection and releasing its permit so the pool can open a replacement. min_connections maintenance still runs. Long-running after_release callbacks are also subject to this deadline.

Would you consider this fix for a 0.9.x patch release before #3582 lands?

Pool exhaustion without recovery is a serious problem for a prod service, and I'm proposing this PR to help address it. I can also contribute the change to #4350 if preferred.

Tests verify permit recovery after stalled pings and callbacks, connection reuse, and minimum-connection replenishment. All pass; the timeout cases fail without the fix. Shutdown stalls aren't separately tested.

Thanks for maintaining sqlx!