feat(tonic-xds): add gRFC A42 ring-hash picker + member tracking

[madhurishgupta]

Summary

Adds the gRFC A42 ring-hash load-balancing picker to the loadbalance stack, giving consistent-hash request affinity: requests carrying the same hash key are routed to the same backend.

What's included

• RingHashPicker (pickers/ring_hash.rs)
  • Builds a hash ring over the cluster's full healthy-EDS membership with uniform per-member weighting.
  • Entries keyed xxh64("{addr}_{i}", 0) (XXH64, seed 0); the ring is held lock-free behind an ArcSwap and rebuilt only on membership change.
  • pick() reads RouteDecision.request_hash (per-request random fallback when absent), finds the ring position closest to that hash (first entry with hash ≥ request, wrapping), and walks clockwise to the first ready host — returning Unavailable if no ring host is ready.
• LoadBalancer member tracking: tracks the full healthy-EDS member set (independent of connection/ejection state), rebuilding the picker's ring once per discovery drain.

Behavior notes

• Outlier detection composes with no ring-hash-specific code. The ring is built over members; picks resolve against the ready set. An ejected host stays in the ring but is absent from ready, so its keys fall through clockwise to the next ready host.

Testing

Added UTs.
cargo fmt, clippy, and cargo test -p tonic-xds all clean.

##nPlan (A42 series)

• Last PR: Request-hash computation + plumbing. (feat(tonic-xds): compute gRFC A42 request hash from header hash policy #2686)
• This PR: Add gRFC A42 ring-hash picker + member tracking
• Third PR: CDS wiring — parse lb_policy: RING_HASH and ring_hash_lb_config (validating hash_function == XX_HASH), and select the ring-hash picker from the cluster's LB policy.
• Fourth PR: RDS wiring — parse RouteAction.hash_policy to populate the policy list (replacing the empty scaffold here).