inspector: fix out-of-bounds read in ws frame decoding

[Nashit-h]

decode_frame_hybi17 checks the announced payload length against buffer.size(), but the payload is read from it + kMaskingKeyWidthInBytes, after the iterator has already walked past the two byte header and the extended length field. A client that sends only the two header bytes of a masked frame, 0x81 0xFD, underflows buffer.size() - kMaskingKeyWidthInBytes to SIZE_MAX, passes the check, and the unmasking loop reads 125 bytes past a two byte vector; the bytes it picks up go to OnWsFrame and back out to the peer. Measuring against what is left after the header fixes both that underflow and the header bytes the old check never accounted for.

[nodejs-github-bot]

Review requested:

• @nodejs/inspector

[Nashit-h]

gentle ping

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76688/

[panva]

@Nashit-h please fix the linter issues, rebase and force push.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.17%. Comparing base (00917ba) to head (1958e12).
⚠️ Report is 886 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64618      +/-   ##
==========================================
+ Coverage   90.14%   90.17%   +0.03%     
==========================================
  Files         741      771      +30     
  Lines      242076   265173   +23097     
  Branches    45558    50362    +4804     
==========================================
+ Hits       218216   239122   +20906     
- Misses      15385    17017    +1632     
- Partials     8475     9034     +559     

Files with missing lines	Coverage Δ
src/inspector_socket.cc	82.90% <100.00%> (+0.04%)	⬆️

... and 403 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.