fix: harden bounded response-body capture against zero-read stall and double-close

[OmarAlJarrah]

Summary

Fixes two related defects in LoggableResponseBody's bounded body-capture path.

1. Bounded drain can spin forever on a zero-read source

drainAndCache() only handled two outcomes from the captured Source: end-of-stream (-1) and a positive read. A source that returns 0 for a positive byteCount — a violation of the Source.read contract — left remaining unchanged, so the loop made no progress and spun forever, hanging the thread that triggered the capture (a caller thread under synchronous logging, or an async completion thread).

The two sibling pump loops written alongside this one (TeeSink.writeAll, RequestBody.copyExactly) already reject a zero-read; this loop was the one that didn't. It now throws an IOException, which the existing drain-error handling caches and source() re-throws — consistent with the documented failure semantics, and snapshot() still returns the bytes captured so far. A zero-read is deliberately not treated as EOF, which would silently truncate the body.

2. Over-cap capture can close the underlying source twice

On the over-cap path the wrapper keeps the delegate's source as a live tail and hands it out inside a PrefixThenTailSource. That inner source closed the tail directly, while the wrapper's own close() independently closed the delegate — and the delegateClosed guard was never set on the inner-source path. For a delegate whose source() returns the same instance and whose close() closes it, the underlying source was closed twice. It is masked today because the bundled Okio adapter's close() is self-guarded, but it is a latent hazard for a custom IoProvider (and the class's own comments already warn that some sockets/streams throw on double-close).

Both close paths now funnel through a single closeDelegateOnce() guard, so whichever fires first wins and the second is a no-op.

Tests

• A response body whose source returns 0 for a positive byteCount: the drain now fails fast instead of timing out (previously hung).
• A delegate whose source() returns the same instance and whose close() closes it: asserts the underlying source is closed exactly once, in both close orders (previously closed twice).

Internal change only — no public API change.

Closes #14
Closes #15