Fix WebSockets Negotiate Auth in Kestrel

[halter73]

Addresses #21886

[Tratcher]

Now the big question is, is this worth backporting and/or asking for .NET 5 GA approval?

Who's the customer? #21886 seems like it's been sitting there a while.

[halter73]

Who's the customer?

@vinaykapoor brought this up on https://gitter.im/aspnet/SignalR this morning. Fortunately @BrennanConroy noticed.

[Tratcher]

Ok, it's at least worth asking about for 5.0 then.

[halter73]

Description

This fixes a bug in Kestrel that prevents WebSocket clients from authenticating using Negotiate Auth. I've copied the Exception you get from ClientWebSocket when encountering this Kestrel bug below:

   System.Net.WebSockets.WebSocketException : Unable to connect to the remote server
---- System.Net.Http.HttpRequestException : Authentication failed because the connection could not be reused.
  Stack Trace:
     at System.Net.WebSockets.WebSocketHandle.ConnectAsync(Uri uri, CancellationToken cancellationToken, ClientWebSocketOptions options)

After this change, Kestrel will keep HTTP/1.1 connections open after "Connection: Upgrade" (WebSocket) requests are challenged by Negotiate Auth with a "401 Unauthorized" response. This allows WebSocket clients to authenticate succesfully.

Customer Impact

Customers are unable to use Kestrel if they need to support Windows Auth for WebSocket connections. We first learned about this back in May and it resurfaced when another customer ran into the issue and reported it on https://gitter.im/aspnet/SignalR yesterday.

Workaround

Using IIS or HttpSysServer instead of Kestrel.

Regression?

No.

Risk

Low. This PR allows some HTTP/1.1 connections to stay open in very specific circumstances where they should not have been prematurely closed. These connections are still tracked and subject to Kestrel's normal keep-alive timeout.

[ghost]

Hello human! Please make sure you've included the Shiproom Template in a comment or (preferably) the PR description. Also, make sure this PR is not marked as a draft and is ready-to-merge.

[Pilchie]

Approved over email.