See #62381 and #60661 for context.

This is a manual dep update due to changes in nghttp2 v1.67.0+ which now treats some stream-level errors as session errors, and internally sends GOAWAY frames to kill the connection (without calling the on_invalid_frame callback). That requires some fixes here to detect those internally triggered GOAWAYs and expose these as HTTP/2 session errors at the end of the core nghttp2 write loop.

Some of these changes will result in user-visible differences to how protocol errors are exposed in Node, moving some error events from the stream to the session, and exposing some errors where previously they were swallowed. After the changes in 1.69.0 (as opposed to 1.67 & 1.68) this only applies to low-level protocol failures like broken flow control or compression failures, not to HTTP validation errors more generally.

This is unfortunate, and in that context it's debatable whether this is a breaking change (new errors from the same traffic) or just a bugfix (we shouldn't silently swallow serious protocol errors) but we can't realistically avoid this if we want to keep nghttp2 up to date, and in some unbundled scenarios the latest nghttp2 will be used regardless. For anything non-trivial this shouldn't cause problems since session errors need to be handled by all applications to deal with existing common production issues like connection resets anyway. The changed behaviour only applies to connections that hit serious protocol errors, and doesn't change anything in normal expected flows.

See the test changes for some examples of how this changes behaviour in practice - the vast majority of h2 tests are unchanged, it's just a couple of specific invalid traffic cases that change. I've also added a new test as well to confirm specifically that we cover the new internally triggered GOAWAYs correctly, and tightened up some checks on the existing tests to confirm everything is working correctly there.

Fixes #60661