fix(tunnel): data race in CloseOnIdle and goroutine leak in sniffingWebsocketFrame

- Use write lock (Lock) instead of read lock (RLock) in CloseOnIdle since
  it modifies the close channel, preventing a race with Close() that could
  panic on double-close of channel.
- Buffer sniffingWebsocketFrame errc to capacity 2 and close both
  connections on first error to ensure the remaining copy goroutine
  unblocks and exits cleanly.

handler/tunnel/tunnel.go

@@ -230,8 +230,8 @@ func (t *Tunnel) Close() error {
 }
 
 func (t *Tunnel) CloseOnIdle() bool {
-	t.mu.RLock()
-	defer t.mu.RUnlock()
+	t.mu.Lock()
+	defer t.mu.Unlock()
 
 	select {
 	case <-t.close: