fix(draft): cap default maxFrameSize and enforce before allocation

[arimu1]

Description

• Introduce Draft_6455.DEFAULT_MAX_FRAME_SIZE (16 MiB) and use it for constructors that previously defaulted to Integer.MAX_VALUE.
• Override checkAlloc in Draft_6455 so declared buffer sizes above maxFrameSize raise LimitExceededException before ByteBuffer.allocate.

Related Issue

Fixes #1507

Motivation and Context

With an uncapped default, the RFC 6455 decoder could honor a peer’s declared payload length and attempt a matching allocation. A conservative default limit and an allocation guard align default server/client drafts with bounded memory use; callers that need larger frames can still pass an explicit inputMaxFrameSize.

How Has This Been Tested?

• mvn test -Dtest=Draft_6455Test (Java 21, Temurin)
• New test asserts default getMaxFrameSize() and that a modest oversized declared length (header only) is rejected without large allocations

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c411ff7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR