Due to a change in the Espressif Arduino core, the TX timeout for the HW CDC
(used in the ESP32-S3, for example) must not be set to 0, as otherwise, an
integer underflow occurs.
Removing the TX timeout is not necessary anymore anyways, because it is now
detected when CDC is not active, and attempts to write will return immediately
until the host read something again. Only when the transmit buffer becomes
full initially, the default timeout of just 100ms takes effect once.
For USB CDC (used with the ESP32-S2, for example), the timeout is not relevant
either.
when changing the security settings (disabling read-only access or
changing the password), existing websocket connections are now closed,
forcing the respective clients to authenticate (with the new password).
otherwise, existing websocket clients keep connected even though the
security settings now expect authentication with a (changed) password.
with ESPAsyncWebServer 3.3.0, the setAuthentication() method became
deprecated and a replacement method was provided which acts as a shim
and uses the new middleware-based approach to setup authentication. in
order to eventually apply a changed "read-only access allowed" setting,
the setAuthentication() method was called periodically. the shim
implementation each time allocates a new AuthenticationMiddleware and
adds it to the chain of middlewares, eventually exhausting the memory.
we now use the new middleware-based approach ourselves and only add the
respective AuthenticatonMiddleware instance once to the respective
websocket server instance.
a regression where enabling unauthenticated read-only access is not
applied until reboot is also fixed. all the AuthenticationMiddleware
instances were never removed from the chain of middlewares when calling
setAuthentication("", "").
