Co-authored-by: lazypassion <25536767+lazypassion@users.noreply.github.com>

Fix DOS attack from malicious pongs

A double channel close panic was possible if a peer sent back multiple
pongs for every ping.

If the second pong arrived before the ping goroutine deleted its channel
from the map, the channel would be closed twice and so a panic would
ensue.

This fixes that by having the read goroutine send on the ping
goroutine's channel rather than closing it.

Reported via email by Tibor Kálmán @kalmant

Please update to the new release ASAP!

HTTP header values, as opposed to header keys,
are case sensitive, but implementation of headerTokens()
before this patch would return lowered values always.

This old behavior could lead to chromium (v87) WebSocket
rejecting connnection because negotiated subprotocol,
returned in Sec-WebSocket-Protocol header (lowered
be headerToken() function) would not match one sent
by client, in case client specified value with capital
letters.

Allow *http.Client with Timeout set

Fix deadlock introduced in v1.8.5

Closes #231

Patch Accept for Gin

Closes #166

Back to GH Actions

See https://github.com/agnivade/wasmbrowsertest/issues/15

Closes #235

Undeprecate InsecureSkipVerify

Less strict about message type of JSON payloads

See https://github.com/nhooyr/websocket/issues/174#issuecomment-613403182

It's more clear than * as an origin pattern.

Add automated test and documentation for echo example

Closes #223

Closes #218

Update master with dev

Closes #215

Closes #213

This doesn't affect real world applications due to buffering but
the testss would occasionally fail on CI due to the code not handling
an immediate close after writing the close frame while resetting
the write timeout.

Closes #208