Fix/polling abandoned session leak

[BenLocal]

Fixes #731.

Reclaims engine.io sessions whose WebSocket upgrade is started but never completed, so
they (and their held-open upgrade connection) can no longer leak.

Motivation

Abandoned WebSocket-upgrade sessions are never reclaimed. The engine Socket, both of
its mpsc channels, the heartbeat task, and the held-open upgrade connection (hyper's
~16 KiB read buffer) are retained forever, so server RSS grows without bound under
connect/abandon churn (#731 reports ~19 GiB over ~20 days behind nginx).

While a session upgrades from HTTP long-polling to WebSocket its heartbeat is paused
(socket.rs, if self.is_upgrading() { interval_tick.tick().await; continue; }). The
upgrade itself (transport/ws.rs::on_init) awaited upgrade_handshake() with no
bound. If a client opens the upgrade request but never completes the 2probe / 5
handshake while keeping the connection open — e.g. a reverse proxy that forwards the
upgrade as a pooled request and never relays the 101, after which the browser silently
falls back to polling — then upgrade_handshake() blocks forever, is_upgrading() stays
true forever, the heartbeat never resumes and so never fires HeartbeatTimeout, and
because the connection is held open there is no transport-close reclaim either. This
matches the issue's dhat profile: heartbeat tasks that "never end" and read buffers rooted
at hyper::server::conn::http1::UpgradeableConnection::poll that are "never dropped".

(For contrast, a pure long-polling session that is abandoned without ever upgrading is
already reclaimed by the existing heartbeat timeout — verified under churn — so the leak
is specific to the upgrade window.)

Solution

Bound the upgrade handshake with a new, configurable upgrade_timeout (default 10 s).
On timeout the session is reclaimed via close_session(DisconnectReason::TransportError),
so the heartbeat-paused upgrade window can no longer leak.

New public API:

• EngineIoConfig::upgrade_timeout + EngineIoConfigBuilder::upgrade_timeout(Duration)
• SocketIoBuilder::upgrade_timeout(Duration)

Tests (both fail without the fix and pass with it):

• engineioxide integration — ws_upgrade_abandoned_timeout: a stalled upgrade is
  reclaimed with DisconnectReason::TransportError.
• engineioxide-e2e (real hyper server over real TCP):
  • abandoned_ws_upgrades_do_not_leak_sessions — 100 concurrent stalled upgrades, every
    client connection held open; all sessions reclaimed after the upgrade timeout.
  • parked_heartbeat_abandoned_upgrade_is_reclaimed — the permanent-leak case where the
    heartbeat parks between pings before the upgrade stalls; only the upgrade timeout can
    reclaim it.

cargo fmt, cargo clippy --all-features, and cargo test --all-features are all green.

[codspeed-hq]

Merging this PR will not alter performance

✅ 87 untouched benchmarks

---

_{Comparing BenLocal:fix/polling-abandoned-session-leak (fc4abd8) with main (1c9fc9a)}

[Totodore]

Thanks for the fix, I can't properly review and test it as I'm holidays. This will be done by the end of June. In the meantime you can temporarily use this fix with cargo git link.

[Totodore]

I won't be able to merge it / release it anytime soon but here are some preliminary comments.

Thanks a lot for the detailed bug report and this fix!