libraries: Add the OneBot v11 channel - #1

The OneBot v11 standard, in Kotlin types and nothing else: the ids and statuses, the twenty message segment types with the unknown ones kept whole, a message in each of the three shapes the API takes, the CQ code format, the events of the four kinds plus an unknown one that keeps its JSON, the 38 public actions with the hidden one and the derived async and rate limited calls, and the layered result model. No transport and no library is involved, so the domain is testable on its own.

The module is discovered by AlexandriteLayout as channels.onebot, which gives it the built-in KSP index, the config root channels.onebot and the plugin id alexandrite-channel-onebot.

A review of the pull request found twelve things. Five are defects and are
fixed here, with the test that would have caught each.

The account header of an HTTP report was looked up as the standard spells it,
while the head reader folds header names to lower case. The header was
therefore never read, and a report that named its account only there was
refused. A test that passed for the wrong reason covered it: its body named
the account too, so the missing lookup was invisible. That case now sends a
body that names none, and a second case covers the header alone.

An answer that came back over a socket was wrapped as data without reading
its status, so a `failed` answer was an `Ok` whose data was the envelope, and
a caller read a delivery that never happened. Socket answers now go through
the same classification as HTTP ones.

The echo counter was a plain long read and written from more than one caller,
so two calls could take the same echo, overwrite each other in the waiting
map, and leave one caller waiting until its timeout. It counts atomically.

The declared length of an HTTP report was used to allocate before it was
checked, so a client could ask the listener for an array of the size it
named; the later check also measured characters rather than bytes. The length
is checked against the limit before the allocation.

The remaining findings are recorded rather than fixed here: an `http_post`
instance has no endpoint to call, so its outgoing actions are unreachable and
the configuration does not let it name one; the data of an answer is read as
an object, so actions such as `get_friend_list` that answer with an array do
not fit their type; a temporary session replies to its group instead of its
sender; `autoEscape` cannot preserve CQ text because every message is sent as
an array; an unknown `message_type` is stored in `postType`; `rateLimit` and
`logUnreadableAnswers` are configured but unused; and a dropped event is not
counted.

Verified: :libraries:channels:onebot:test passes, 75 tests.

Three findings of the review that were deferred, and should not have been.

A temporary session of a group is a private message whose address keeps the
group as its chat and the sender as its thread, and the mapping already said
that a reply goes back to the sender. The channel ignored the thread and
picked `send_group_msg` for the group, so an answer to a private message was
posted into the group. `privateTemporary` names the sender of such a session
and both the action and the parameters ask for it first.

Every message was sent as an array of segments, which is a shape that cannot
be taken literally, so `autoEscape` asked an implementation to preserve CQ
text and then handed it the text already cut into segments. A message is sent
in the shape it was written in, and `auto_escape` is asked for only by a
message that is one piece of text, the only shape an implementation can take
as written.

Verified: :libraries:channels:onebot:test passes, 77 tests.

…e drops

Five findings of the second review, all of them about a connection being
trusted for more than it is.

The HTTP receiver gave every accepted connection a thread of its own with no
bound and no limit on the whole request, so a client sending a byte at a time
held a thread for as long as it liked: `soTimeout` measures the gap between
two reads, not the request. The readers are now a bounded pool with a bounded
queue, a connection past that is answered 503 as busy instead of being held,
and the whole request carries a deadline that the head and the body are both
checked against.

The reverse listener read frames from every socket the library had upgraded,
not from the peer it serves, so a connection it had refused or one that a
newer peer replaced could report an event or answer a call of the connection
being served. Frames of a socket that is not the active peer are ignored now.
Its close was read the same way: a refused or superseded socket closing ended
every waiting call of the active connection, and now a close says nothing
about a connection that is not the one closing.

The count of dropped events was derived from the room the queue had, which
made it shrink as a reader caught up and reach zero once it had. The queue
names each event it never delivers, which is what is counted instead, so the
count only grows.

The header case test named its account in the body as well as the header, so
it was taken whichever of the two was read and passed even with the header
lookup broken. The body names no account now, which makes being taken the
header path working and nothing else.

Verified: :libraries:channels:onebot:test passes, 83 tests.

…sage

Two findings of the second review that were left open.

A typed request wrote its ids as JSON strings, bypassing the serializers
that emit a number when the id fits in a `Long`, and the standard declares
these parameters numeric: a strict implementation is free to refuse a call
it would otherwise take. `UserId`, `GroupId` and `MessageId` now go through
the same numeric serializer the segments use, falling back to a string only
when the id is too large for one.

A reply named its target by constructing a numeric `MessageId` from whatever
the reference held, and this mapper is also what names a delivery `sent` or
`async` when the implementation answered with no id. Answering such a message
therefore threw before anything was sent, turning a lost thread into a lost
reply. A reference that names no message of the implementation is left out of
the answer's segments, so the answer is sent.

Verified: :libraries:channels:onebot:test passes, 85 tests.

Findings of the third review, which cover the listener, the sockets and the
credentials.

A configured value shorter than four characters was left in the clear, so a
short access token could be echoed back by an implementation and reach a
failure message. Nothing says a token is long, so every value that is not
empty is now replaced.

An answer over a socket carries the `echo` this client sent to match it to
its call, and this is not an id the implementation gave the message: a
delivery that named it invented one, quoted, where the documented fallback is
`sent`. The echo is no longer read as a name.

The declared body of a report over the limit was dropped without a deadline,
so a sender dripping it just faster than the idle timeout held a reader for
as long as it liked. The drain is under the same deadline as the request, and
its case now sends for longer than the deadline so that a listener without
one fails rather than passes.

Closing a forward connection cancelled the scope before the close handler
could end the calls that were waiting, so a caller stayed suspended past
`stop` until its own timeout. The waiting calls are ended first.

A reverse peer that replaced the one being served took over the connection
while the calls sent on the peer it replaced stayed in the map, waiting for
an answer that could no longer be read. Those calls are ended and the peer
they were sent on is closed before the newer one is served.

Escaping a comma was shared by plain text and by parameter values, but a
comma only ends a parameter: ordinary text had every comma turned into
`,`, and a literal `,` in text was read back as a comma. Text and
parameter values have their own escaping now, and the two cases that asserted
the old behaviour assert the new one.

Verified: :libraries:channels:onebot:test passes, 85 tests.