http2: don't suppress internal termination detection on a peer GOAWAY

[mcollina]

When a peer sends GOAWAY(NO_ERROR), core.js calls session.close(), which
sets both graceful_close_initiated_ and goaway_initiated_. Those flags
can be set without any application code, and once set are never reset, so
they could permanently disarm the detector that tears down the session when
nghttp2 internally terminates it after a protocol error (for example an
oversized frame).

This makes the detector compare the GOAWAY error code against the code the
session requested through session.goaway() / session.close(). A
peer-triggered graceful close submits GOAWAY(NO_ERROR); if nghttp2 later
emits a frame carrying a different error code it was not requested by us,
which indicates an internal termination. In that case the session is torn
down and the resulting error is surfaced, as it would be without the prior
peer GOAWAY.

Defense-in-depth hardening; no test is included because the triggering
scenario is not reproducibly exercised by the default build.

---

AI generated, reviewed by me.

[nodejs-github-bot]

Review requested:

• @nodejs/http2
• @nodejs/net

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.44%. Comparing base (ebef774) to head (8cf2198).
⚠️ Report is 460 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_http2.cc	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66641      +/-   ##
==========================================
+ Coverage   90.28%   90.44%   +0.15%     
==========================================
  Files         790      791       +1     
  Lines      271642   276613    +4971     
  Branches    51846    53128    +1282     
==========================================
+ Hits       245260   250177    +4917     
+ Misses      16889    16853      -36     
- Partials     9493     9583      +90     

Files with missing lines	Coverage Δ
src/node_http2.h	92.47% <100.00%> (+0.08%)	⬆️
src/node_http2.cc	82.05% <75.00%> (-0.03%)	⬇️

... and 236 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pimterry]

All the tests are failing.

The current approach here has some clear false negatives, e.g. if we manually set the same error code that nghttp2 generates internally, we'd still hit the original issue. I'm not sure trying distinguish specific frames more precisely than "completely unexpected" is going to work well.

I think there's a better approach: nghttp2 says given want_read() == 0 && want_write() == 0, the application should drop the connection, and we could use that to detect this issue instead. In all of the cases we're looking at here, we'll reach that state unexpectedly. So in any scenario where we think we have an open stream on a session, but nghttp2 says the session is dead => an internal error must have happened somewhere.

Something like (AI gen):

bool Http2Session::HasStreamsAbandonedByNghttp2() const {
  if (HasPendingData()) return false;
  return std::ranges::any_of(streams_, [](const auto& entry) {
    return !entry.second->is_closed() && !entry.second->is_destroyed();
  });
}

and then make the check at the end of SendPendingData into:

if (internal_goaway_sent_ || HasStreamsAbandonedByNghttp2()) {
...

I'm surprised the description says this isn't testable - it looks very reachable I think, and Claude whipped up a few examples that seem to hit this immediately.