client validation of websocket upgrade response

[lachlan-roberts]

the websocket client does not fail websocket connection on receiving an upgrade response which includes an extension which it did not request

RFC6455

If the response includes a |Sec-WebSocket-Extensions| header
field and this header field indicates the use of an extension
that was not present in the client's handshake (the server has
indicated an extension not requested by the client), the client
MUST _Fail the WebSocket Connection_.

https://tools.ietf.org/html/rfc6455#section-4.1

In my testing of #3460 I managed to put an unrequested extension in the upgrade response with no error from the client. This was tested on jetty 10.0.x but may be an issue on 9.4.x as well.

[lachlan-roberts]

This seems to be a problem with subprotocol as well, the client will accept a subprotocol which it did not request.

For the sending of the response on the server side the, logic seems to be wrong
https://github.com/eclipse/jetty.project/blob/67838609c3059134c3a3374f3de745f66a2ec6d4/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/core/server/internal/RFC6455Handshaker.java#L155-L175
If there are no requested subprotocols and there is a subprotocol then this is allowing that to be sent.