[BUG] Sliding-window counts stale entries before cleanup, causing spurious rejection

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-fault-tolerance/shenyu-plugin-ratelimiter/src/main/resources/META-INF/scripts/sliding_window_request_rate_limiter.lua:34-52`
- description: The script computes `last_requested = zcard(tokens_key)` (line 37) and the allow decision (line 43) BEFORE calling `zremrangebyscore(tokens_key, 0, now - window_size)` (line 51). Entries whose score is already outside the window are still counted, then removed afterward.
- impact: Intermittent false-negative (429) on the request that crosses the window boundary.
- suggested_fix: Move `zremrangebyscore` before the `zcard` count.
- confidence: Medium-High
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with shenyu-plugin/shenyu-plugin-fault-tolerance/shenyu-plugin-ratelimiter/src/main/resources/META-INF/scripts/sliding_window_request_rate_limiter.lua, especially lines 34-52, and trace the order of cleanup, counting, and the allow decision. Done means entries outside the window are removed before counting, preventing a spurious 429 at the window boundary.

Written by the indexing model from the issue text.