fix: bound push responses and reject interrupted streams

[yotatameguchi-boop]

A push service can send an arbitrarily large response or terminate a response before its advertised body is complete. Previously, sendNotification() buffered the entire body without a limit and listened for errors only on the request. A truncated response emits an error on the response stream, leaving the notification promise pending even when a socket timeout was configured.

This change caps buffered responses at 64 KiB, destroys oversized requests, and rejects notification promises on response stream errors. The README documents the response limit and transport errors, plus endpoint validation and socket timeout considerations for applications accepting untrusted subscriptions.

Endpoint allowlisting remains an application responsibility. There is no default timeout or total request deadline; a socket timeout bounds inactivity rather than total response time. The 64 KiB limit intentionally changes handling of unusually large service responses.

Validation on Node.js 24.18.1:

• Two new interrupted-response tests (with and without a configured timeout) failed by timing out before the fix and pass after it.
• Added coverage for a stalled response hitting its socket timeout, a response exactly at 64 KiB, and a response one byte over the limit. The existing oversized-response test also passes.
• npm run lint: passed.
• npx mocha --ui tdd 'test/test-*.js' test/testSetGCMAPIKey.js test/testSendNotification.js: 137 passing.
• git diff --check: passed.

All network regression tests use a local HTTPS fixture. Browser integration tests were not run locally.