Reduce blocking of event loop when updating ip lists

[timokoessler]

Simpler approach than #1122

[aikido-pr-checks]

🟡 Medium - Async IP-list rebuilds keep enforcing the old access policy during config reloads

The new update*IPAddresses methods yield back to the event loop before replacing the in-memory matchers, and Agent.updateBlockedLists now awaits those async rebuilds during live list refreshes. While that rebuild is in progress, request handling continues to call isAllowedIPAddress/isIPAddressBlocked against the previous lists, so a newly denied or newly blocked IP can still reach the application until the update finishes. Before this change the event loop stayed blocked until the new lists were installed, so this PR creates a real window where IP-based protections are bypassed.

Show fix

Do not yield while the active policy is still the old one. Either build the new matchers off-thread and swap all affected lists atomically once the full snapshot is ready, or fail closed during reloads for policies that are becoming more restrictive so requests cannot be evaluated against stale allow/block data.

_{More info - Reply on this comment to give feedback or ignore the issue.}

[codecov]

Codecov Report

❌ Patch coverage is 95.74468% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
library/agent/ServiceConfig.ts	94.87%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!