Skip SSE config updated events if they arrive too fast

[hansott]

No description provided.

[aikido-pr-checks]

🟡 Medium - SSE throttle can suppress newer security config updates for up to a minute

After the first refresh starts, any later config-updated event inside the 9-second window is dropped before its configUpdatedAt value is recorded, even when it announces a newer config or the previous fetch failed. Because the only remaining recovery path is the background RealtimeTask poll that runs every 60 seconds, firewall lists, route allowlists, and outbound blocking rules can stay stale for nearly a minute and requests that should have been blocked can continue to pass during that window.

Show fix

Do not permanently discard newer SSE updates during the throttle window. Instead, coalesce them by remembering the highest pending configUpdatedAt seen while a refresh is in progress/throttled and trigger one follow-up fetch when the window expires, or only rate-limit duplicate timestamps while still processing newer versions immediately.

_{More info - Reply on this comment to give feedback or ignore the issue.}

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...v/aikido/agent_api/background/RealtimeSSETask.java	90.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!