feat(publish): Support 'publish.timeout' config behind '-Zpublish-timeout'

[epage]

Originally, crates.io would block on publish requests until the publish
was complete, giving cargo publish this behavior by extension. When
crates.io switched to asynchronous publishing, this intermittently broke
people's workflows when publishing multiple crates. I say interittent
because it usually works until it doesn't and it is unclear why to the
end user because it will be published by the time they check. In the
end, callers tend to either put in timeouts (and pray), poll the
server's API, or use crates-index crate to poll the index.

This isn't sufficient because

• For any new interested party, this is a pit of failure they'll fall
  into
• crates-index has re-implemented index support incorrectly in the past,
  currently doesn't handle auth, doesn't support git-cli, etc.
• None of these previous options work if we were to implement
  workspace-publish support (cargo publish multiple packages at once #1169)
• The new sparse registry might increase the publish times, making the
  delay easier to hit manually
• The new sparse registry goes through CDNs so checking the server's API
  might not be sufficient
• Once the sparse registry is available, crates-index users will find
  out when the package is ready in git but it might not be ready through
  the sparse registry because of CDNs

This introduces unstable support for blocking by setting
publish.timeout to non-zero value.

A step towards #9507