MM-21012: Revamp websocket implementation (#16620)

* MM-21012: Revamp websocket implementation

We replace the old gorilla/websocket implementation with the
gobwas/ws library. The gorilla library was in maintenance mode
and had a high level API due to which we cannot use that for
situations where a large number of concurrent connections needs
to be supported.

The ws library is a very low-level library that allows us
to work with raw net.Conns. We make several improvements:

- We completely remove the reader goroutines, and instead
replace them with a manual epoll implementation which sends off
messages to be read when it receives any data on the connection.
This lets us scale to a much larger number of connections.
- The reader buffer is eliminated, because we directly read
from the connection now.

https://mattermost.atlassian.net/browse/MM-21012

```release-notes
Improved the websocket implementation by using epoll manually
to read from a websocket. As a result, the number of goroutines
is expected to go down by half.
```

* fix tests

* fix shadowing errors

* final changes

* windows support!

* Remove pointer to waitgroup

* Fix edge case

* Trigger CI

* Trigger CI

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

utils/api.go

@@ -13,6 +13,7 @@ import (
 	"net/url"
 	"path"
 	"strings"
+	"unicode/utf8"
 
 	"github.com/mattermost/mattermost-server/v5/model"
 )
@@ -27,19 +28,58 @@ func CheckOrigin(r *http.Request, allowedOrigins string) bool {
 		return true
 	}
 	for _, allowed := range strings.Split(allowedOrigins, " ") {
-		if allowed == origin {
+		if equalASCIIFold(allowed, origin) {
 			return true
 		}
 	}
 	return false
 }
 
+// equalASCIIFold returns true if s is equal to t with ASCII case folding as
+// defined in RFC 4790.
+// Copied from gorilla/websocket/util.go
+func equalASCIIFold(s, t string) bool {
+	for s != "" && t != "" {
+		sr, size := utf8.DecodeRuneInString(s)
+		s = s[size:]
+		tr, size := utf8.DecodeRuneInString(t)
+		t = t[size:]
+		if sr == tr {
+			continue
+		}
+		if 'A' <= sr && sr <= 'Z' {
+			sr = sr + 'a' - 'A'
+		}
+		if 'A' <= tr && tr <= 'Z' {
+			tr = tr + 'a' - 'A'
+		}
+		if sr != tr {
+			return false
+		}
+	}
+	return s == t
+}
+
 func OriginChecker(allowedOrigins string) func(*http.Request) bool {
 	return func(r *http.Request) bool {
 		return CheckOrigin(r, allowedOrigins)
 	}
 }
 
+func SameOriginChecker() func(*http.Request) bool {
+	return func(r *http.Request) bool {
+		origURL, err := url.Parse(r.Header.Get("Origin"))
+		if err != nil {
+			return false
+		}
+		u := url.URL{
+			Host:   r.Host,
+			Scheme: origURL.Scheme,
+		}
+		return CheckOrigin(r, u.String())
+	}
+}
+
 func RenderWebAppError(config *model.Config, w http.ResponseWriter, r *http.Request, err *model.AppError, s crypto.Signer) {
 	RenderWebError(config, w, r, err.StatusCode, url.Values{
 		"message": []string{err.Message},