new feature: add max elapsed time support to RetryLayer

### Feature Description

Add `RetryLayer::with_max_elapsed_time(Duration)` to stop scheduling retries after a configured time budget.

### Problem and Solution

Lance exposes `client_retry_timeout` and uses it for its native object store providers. Lance is adding retry support for OpenDAL-backed stores in:

https://github.com/lance-format/lance/pull/8363

OpenDAL can map `client_max_retries` to `RetryLayer::with_max_times`, but currently has no equivalent for `client_retry_timeout`.

The elapsed-time primitive should first be implemented in BackON because BackON owns the retry state machine. OpenDAL can then expose it through `RetryLayer` and apply it consistently to normal and stateful operations.

The timer should start with the first attempt. After a retryable failure, BackON should stop scheduling retries when either the elapsed-time budget or `max_times` is reached. It should not cancel an attempt or sleep already in progress.

### Additional Context

BackON implementation PR: https://github.com/Xuanwo/backon/pull/241

OpenDAL implementation PR: https://github.com/apache/opendal/pull/8111

Expected order:

1. Implement and release the elapsed-time primitive in BackON.
2. Expose it through OpenDAL `RetryLayer`.
3. Map Lance `client_retry_timeout` to the OpenDAL API.

### Are you willing to contribute to the development of this feature?

- [x] Yes, I am willing to contribute to the development of this feature.

Start by reviewing the BackON implementation PR #241, then the OpenDAL implementation PR #8111 and the related Lance PR #8363. Trace how RetryLayer and BackON's retry state machine handle the first attempt, retryable failures, max_times, and elapsed-time limits. Done means the elapsed-time primitive is released in BackON, exposed through OpenDAL, and usable for normal and stateful operations.

Written by the indexing model from the issue text.