http2: treat non-EOF empty frames like other invalid frames

http2: fix setting options before handle exists

Currently, when a JS Http2Session object is created, we have to handle the situation in which the native object corresponding to it does not yet exist. As part of that, we create a typed array for storing options that are passed through the AliasedStruct mechanism, and up until now, we copied that typed array over the native one once the native one was available.

This was not good, because it was overwriting the defaults that were set during construction of the native typed array with zeroes.

In order to fix this, create a wrapper for the JS-created typed array that keeps track of which fields were changed, which enables us to only overwrite fields that were intentionally changed on the JS side.

It is surprising that this behavior was not tested (which is, guessing from the commit history around these features, my fault). The subseqeuent commit introduces a test that would fail without this change.

http2: treat non-EOF empty frames like other invalid frames

Use the existing mechanism that we have to keep track of invalid frames for treating this specific kind of invalid frame.

The commit that originally introduced this check was 695e38be, which was supposed to proected against CVE-2019-9518, which in turn was specifically about a flood of empty data frames. While these are still invalid frames either way, it makes sense to be forgiving here and just treat them like other invalid frames, i.e. to allow a small (configurable) number of them.

Fixes: https://github.com/nodejs/node/issues/37849

@nodejs/http2