Fix race conditions in the SSE and WS code

[mathieucarbou]

No description provided.

[Copilot]

Pull request overview

This PR addresses a race condition in the Server-Sent Events (SSE) message queuing path by ensuring the queue overflow check happens after acquiring the ESP32 message-queue lock.

Changes:

• Moved _messageQueue.size() overflow checks to occur after _lockmq is acquired (ESP32 builds).
• Applied the same ordering fix to both _queueMessage overloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[willmmiles]

This change may be incorrect. Client callbacks shouldn't be called while holding the lock -- if the client does something like "hmm, I'm done with this server now, lets destruct it" we'll have a bad time.

[mathieucarbou]

The same issue existed here:

void AsyncEventSource::_addClient(AsyncEventSourceClient *client) {
if (!client) {
return;
}
#ifdef ESP32
std::lock_guardstd::recursive_mutex lock(_client_queue_lock);
#endif
_clients.emplace_back(client);
if (_connectcb) {
_connectcb(client);
}

_adjust_inflight_window();
}

[mathieucarbou]

I added 2 commits in #415 to fix the 2 situations.