Don't crash on window adjust for a closed child channel

[andrewkomkov]

Problem

ChildChannelStateMachine.sendChannelWindowAdjust calls preconditionFailure("Sent channel window adjust on channel in invalid state") for the closedLocally, closedRemotely, and closed states. Since preconditionFailure is fatal, hitting any of those states crashes the entire process.

This is reachable in normal operation. On a multiplexed session, a read can be delivered from the multiplexer's pending-read queue after the child channel has been closed locally (for example, the application cancels or closes a channel while reads are still in flight). Servicing that buffered read advances the inbound window and triggers an outbound window adjust, by which point the child channel state machine is already in a closed state, so the precondition fires and the whole process dies.

Stack summary

fatalError / preconditionFailure
  ChildChannelStateMachine.sendChannelWindowAdjust(...)   <- closedLocally / closedRemotely / closed
  SSHChildChannel (servicing a pending read after local close)
  SSHChannelMultiplexer (draining the pending-read queue)

Fix

sendChannelWindowAdjust already throws, so the closed states do not need to be fatal. For closedLocally, closedRemotely, and closed we now throw NIOSSHError.protocolViolation instead of calling preconditionFailure. The caller fails the associated promise and errors the channel, which is already closing, so the outcome is a clean, contained error rather than process death.

requestedLocally and requestedRemotely keep the existing preconditionFailure, since reaching those states here genuinely indicates an internal logic error.

Testing

• swift build succeeds.
• swift test passes (320 tests, 0 failures).

I understand the Swift project may require a CLA; happy to sign it.