Add opt-in memory-headroom backpressure for EventPublisher + MWorkerQueue - #70053

…ueue

Mirrors the minion-side pattern in saltstack#70038 (minion_memory_headroom) so
operators running the master under a tight cgroup limit (VMSP small = 1
GiB, k8s memory.limit, etc.) can bound in-flight work per subprocess
before OOM.

Four new master config options:

  event_publisher_memory_headroom   (str/int, default None)
  event_publisher_memory_max        (str/int, default None)
  mworker_queue_memory_headroom     (str/int, default None)
  mworker_queue_memory_max          (str/int, default None)

Plus a shared knob controlling the sample cadence:

  event_publisher_memory_check_interval  (float, default 0.5)

Value semantics match saltstack#70038 exactly:

* headroom: percentage string ("5%") or absolute size ("500M", "5G",
  int bytes).
* max: absolute size / int bytes override for the reference "total
  memory available".
* Reference-total precedence: max opt > cgroup v2 > cgroup v1 >
  psutil.virtual_memory().total.

When neither opt in a pair is set, no check runs and behavior is
byte-for-byte identical to the previous unbounded default. Opt-in only,
per the LTS convention (saltstack#69443 auth_retries, saltstack#69597 gpg_decrypt).

Enforcement:

* MasterPubServerChannel._publish_daemon creates an asyncio.Event gate
  (initially set = permit) and a PeriodicCallback that toggles the gate
  every event_publisher_memory_check_interval seconds based on
  has_memory_headroom(). publish_payload awaits the gate before
  dispatching a new event.  Backpressure propagates upstream via the
  puller's existing inline await.

* MWorkerQueue.zmq_device_pooled caches the check result for the same
  interval and, when the check fails, skips recv_multipart on the
  ROUTER socket for that poll iteration.  Messages stay in ZMQ's ROUTER
  queue; once RCVHWM fills, peer sends block per ZMQ semantics.  Worker
  responses (DEALER -> ROUTER) are always drained so in-flight work can
  complete.

* MWorkerQueue.zmq_device (non-pooled) is a C-level
  zmq.device(zmq.QUEUE, ...) proxy with no Python hook point; setting
  the opts here logs a warning at start-up and has no effect.

Helpers extracted to a new module salt/utils/memory.py so the master
paths here and the minion path in saltstack#70038 can converge on the same
implementation.  When saltstack#70038 lands the minion's private helpers can be
refactored to import from salt.utils.memory in a follow-up.

Docs at doc/ref/configuration/master.rst.  Tests to follow in a
subsequent commit on this branch.

Covers the new salt.utils.memory helpers and the two enforcement paths
introduced in the preceding commit:

* tests/pytests/unit/utils/test_memory.py (new): 51 cases spanning
  parse_size, parse_headroom, _read_cgroup_file, _parse_self_cgroup,
  _detect_cgroup_memory, resolve_memory_reference precedence chain,
  and the full has_memory_headroom matrix (both opts unset -> True;
  psutil missing -> True; over-limit -> False + WARNING log;
  bogus headroom -> 5% fallback; exceptions swallowed).  Mirrors the
  fixture shape from saltstack#70038's tests/pytests/unit/test_minion_memory_headroom.py.

* tests/pytests/unit/channel/test_server.py: 6 cases covering the
  MasterPubServerChannel._ep_memory_gate contract -- no-opt is a permit,
  set-from-start is a no-op, cleared blocks publish_payload,
  mid-await set releases it, and the PeriodicCallback closure toggles
  the gate based on has_memory_headroom's return value.

* tests/pytests/unit/transport/test_zeromq.py: 7 cases covering
  MWorkerQueue -- the non-pooled zmq_device warning fires (and only
  fires) when an opt is set; pooled zmq_device_pooled skips ROUTER
  recv_multipart when has_memory_headroom is False, always drains
  DEALER responses (worker replies must flow), admits when headroom
  is OK, caches the check per event_publisher_memory_check_interval,
  and never calls the check on the default (unset-opts) path.