Fix(network): bound hole punching forward limiter keys

[chenyukang]

Problem Summary:

The previous limiter used (from, to, message type) as the key, where from and to come from forwarded messages. A peer could keep sending messages with fresh peer IDs and grow the keyed rate limiter state indefinitely.

What is changed and how it works?

Keep the existing per-(from, to, message type) forwarding rate-limit semantics, but replace the unbounded governor keyed store with a bounded TTL-backed limiter. This prevents peers from growing limiter state indefinitely by sending messages with fresh message-controlled peer ids.

What's Changed:

Related changes

• PR to update owner/repo:
• Need to cherry-pick to the release branch

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Side effects

• Performance regression
• Breaking backward compatibility