GO-7561 acl: only the first consensus event finishes loading an acl object

[requilence]

Problem

newAclObject waits for the first consensus event of its watch. Both AddConsensusError and AddConsensusRecords closed ready while the store was still empty, so a watch that delivered more than one event before the object was dropped closed it twice:

panic: close of closed channel

This can happen in any service that uses acl.New() (coordinator, filenode, filenode2):

• the consensus client hands a whole batch of events to the watcher while holding its mutex, so newAclObject can't unwatch between them;
• a watch that times out and is watched again can receive the stale error of the first watch;
• after GO-7561 concurrent AddLog of the same log returns ErrLogExists instead of WriteConflict any-sync-consensusnode#115, an UnWatch + Watch of a missing log while the client restores its watches after a reconnect (the restore is sent outside the client mutex) can get two errors for the same watcher; before, the server skipped the second request.

Records that arrived after records which failed to build a list also reached a nil list.

Fix

The first event finishes the load, once (finishLoad). After a failed load, later events are dropped; after a successful one, records are added as before and an error is only logged, now with the space id.

Tests

TestAclObject_EventsAfterTheFirst: error then records, two errors, and broken records then records panic on main; an error after the records leaves the object loaded.

Part of GO-7561. Must be deployed to the coordinator and both filenodes before anyproto/any-sync-consensusnode#115.

Release: services are on any-sync v0.13.6, and main after it also has #802 (GO-7556, net/pool and net/peer changes). Either tag a v0.13.6-based patch with only this change, or ship #802 together with it.

[github-actions]

New Coverage	63.2% of statements
Patch Coverage	91.7% of changed statements (11/12)

---

^{Coverage provided by https://github.com/seriousben/go-patch-cover-action}