In Node.js versions >= 22.23.2 < 23.0.0, >= 24.18.1 < 25.0.0, and
>= 26.5.1, the HTTP server rejects the request before emitting the
`'upgrade'` event.

Refs: nodejs/node@064d339f

Direct security reporters to use private vulnerability reporting on
GitHub as the primary reporting channel.

This reverts commit 8e9511b.

Refs: coverallsapp/github-action@8d6379e1

When a server is configured with `clientMaxWindowBits = N` and a client
offers `client_max_window_bits = M` where `M < N`, the server must not
respond with a value greater than `M`.

Previously the server accepted such offers and responded with
`client_max_window_bits = N`. The analogous check for
`serverMaxWindowBits` already existed; this commit adds the symmetric
check for `clientMaxWindowBits`.

`Sender.prototype.close()` validates `code` and `data` and throws if
they are invalid. Do not change the ready state before it returns,
otherwise the state is set to `CLOSING` with no close frame sent and no
close timer set, and any subsequent `WebSocket.prototype.close()` call
becomes a noop because the state is already `CLOSING`.

Allow specifying subprotocols with the `protocols` option.

Refs: whatwg/websockets#42