fix(security): reject malformed Realtime WebSocket event frames (#2391)