fix S113 violations: add HTTP timeouts (#1312)

Closes #1312 (closed)

this updates external HTTP calls to use bounded timeouts to avoid potential indefinite blocking. I used a default of (5, 30) for the client-side and file backend requests.

As discussed, the Signon provider now accepts a configurable timeout, nd the SystemBootstrap task can read an http_timeout value from its task data (defaulting to 30s if not provided).

verified locally with make check & tox