fix(protocol): release Data charge to its owning session

Data charged against a ProtocolSession kept only the charge amount, so
data_destroy released it from whatever session was thread-locally bound
at destroy time. Destroying a received Data on another thread, after the
session was unbound, or while a different session was bound leaked the
originating session's budget and underflowed the other's.

Add Data.owner, set it whenever protocol_receive_data_limited charges a
session, and have data_destroy release against that owner directly via
the newly-exported protocol_release_memory_for_session. Uncharged Data
(owner NULL) keeps the previous bound-session fallback.

Add a unit test proving a Data acquired on session A is released to A
even when unrelated session B is bound at destroy time.

src/shared/data.h

@@ -3,11 +3,19 @@
 
 #include <stdlib.h>
 
+/* Forward declaration for the connection budget a received Data is charged
+ * against; defined in protocol.h (which includes this header). */
+typedef struct ProtocolSession ProtocolSession;
+
 typedef struct {
   void* data;
   size_t size;
   /* Non-zero only for a buffer charged to the protocol connection budget. */
   size_t protocol_charge;
+  /* Session whose budget `protocol_charge` was reserved from.  The charge must
+   * always be returned to this session, regardless of which session (if any) is
+   * bound to the destroying thread.  NULL for uncharged Data. */
+  ProtocolSession* owner;
 } Data;
 
 Data* data_create_empty(size_t data_size);
@@ -15,5 +23,8 @@ Data* data_create_reserve(size_t size);
 Data* data_create(void* data, size_t data_size);
 void data_destroy(Data* data);
 void protocol_release_memory(size_t charge);
+/* Release `charge` against `session` directly instead of the thread-local bound
+ * session.  Used by data_destroy to honor Data.owner. */
+void protocol_release_memory_for_session(ProtocolSession* session, size_t charge);
 
 #endif