[release/8.0-staging] Deny unmasked frame receive for WebSocket Server

[liveans]

Backport of #123485 to release/8.0-staging

Increasing RFC compliance for WebSocket

Customer Impact

RFC compliance

Regression

No

Testing

Manual verification + automated tests

Risk

Low, the change only affects non‑compliant WebSocket clients sending unmasked frames, which is explicitly disallowed by RFC 6455. No behavior change is expected for compliant clients.

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR backports WebSocket RFC 6455 compliance improvements from #123485 to the release/9.0-staging branch. It adds server-side validation to reject unmasked frames from clients, which is required by the WebSocket protocol specification.

Changes:

• Added validation logic to deny unmasked frames received by WebSocket servers
• Added corresponding error message resource string
• Added unit test to verify the new validation behavior

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Adds validation to reject unmasked frames when operating as a server, following RFC 6455 requirements
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds error message resource for the unmasked frame validation error
src/libraries/System.Net.WebSockets/tests/WebSocketTests.cs	Adds test case to verify servers reject unmasked frames and enter Aborted state with appropriate error message