Fix TlsHandler.FinishWrap null promise masking AuthenticationException

[maksimkim]

Summary

Fixes #60 — When TLS certificate validation fails, a NullReferenceException from Wrap/FinishWrap masks the real AuthenticationException.

Root Cause

Two interrelated bugs combine to replace the original AuthenticationException with a NullReferenceException:

1. Decode's catch block calls WrapAndFlush in a try/finally with no catch — if WrapAndFlush throws, its exception replaces the original cause.
2. Wrap method calls _pendingUnencryptedWrites.Remove() without null-checking — Remove() returns null when the queue was drained re-entrantly by HandleFailure → RemoveAndFailAll.

Changes

Fix 1: Catch WrapAndFlush exceptions in Decode (TlsHandler.Reader.cs)

Added catch (Exception) { } clause so WrapAndFlush exceptions don't mask the original cause.

Fix 2: Null-check Remove() return in Wrap (TlsHandler.Writer.cs)

Added if (promise is null) { break; } after Remove() to handle the queue being drained externally.

Fix 3: Guard FinishWrap/FinishWrapNonAppData (TlsHandler.Writer.cs)

Added _outboundClosed check at the start of all four overloads to short-circuit writes after the handler enters a failure state.

Fix 4: Protect _sslStream.Dispose() in Close (TlsHandler.cs)

Wrapped _sslStream.Dispose() in try-catch to prevent dispose exceptions from propagating during channel close.

Regression test (TlsHandlerTest.cs)

Added CertValidationRejection_ShouldNotThrowNullReferenceException — configures a TLS client that rejects the server certificate and verifies the TlsHandshakeCompletionEvent contains the real exception, not a NullReferenceException.

[maksimkim]

/azp run

[maksimkim]

@copilot why ci pipelines were not executed on this PR?

[Copilot]

@copilot why ci pipelines were not executed on this PR?

I checked the CI config and run history: this repo currently has no regular GitHub Actions CI workflow, and the Azure pipeline YAML (build/pr-validation.yaml) is configured to trigger only for future and release/* branches, not master PRs. Since this PR targets master, CI won’t auto-run unless the branch filters are updated (or a pipeline is manually run with matching configuration).

[maksimkim]

/azp run